CVE-2025-59160: 
JavaScript vulnerability analysis and mitigation

CVE-2025-59160 affects the Matrix JavaScript SDK (matrix-js-sdk), a Matrix Client-Server SDK for JavaScript and TypeScript. The vulnerability was discovered and disclosed on September 16, 2025, affecting versions before 38.2.0. The issue involves insufficient validation of room predecessor links in the MatrixClient::getJoinedRooms functionality (GitHub Advisory, NVD).

The vulnerability stems from insufficient validation when considering a room to be upgraded by another in the MatrixClient::getJoinedRooms function. The CVSS v4.0 score is 2.7 (LOW) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U. The weakness is classified as CWE-345 (Insufficient Verification of Data Authenticity) (NVD).

The vulnerability allows a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room. This could potentially lead to confusion or misdirection of users to unintended rooms (GitHub Advisory).

The vulnerability has been patched in version 38.2.0 of matrix-js-sdk. Users are advised to upgrade to this version. As a workaround, developers can avoid using MatrixClient::getJoinedRooms and instead use getRooms() while filtering upgraded rooms separately (GitHub Advisory).