CVE-2024-42347

Name of the Vulnerable Software and Affected Versions matrix-react-sdk versions prior to 3.105.0

Description A malicious homeserver could manipulate a user's account data to cause the client to enable URL previews in end-to-end encrypted rooms, in which case any URLs in encrypted messages would be sent to the server. Deployments that trust their homeservers, as well as closed federations of trusted servers, are not affected.

Recommendations For versions prior to 3.105.0, upgrade to version 3.105.0 or later to resolve the issue. As a temporary workaround, consider disabling URL previews in end-to-end encrypted rooms until a patch is available.