—
GO-2023-2053
matrix-media-repo: Unsafe media served inline on download endpoints in github.com/turt2live/matrix-media-repo
Quick fix
GO-2023-2053 — github.com/turt2live/matrix-media-repo: upgrade to the fixed version with the command below.
go get github.com/turt2live/matrix-media-repo@v1.3.0Details
matrix-media-repo: Unsafe media served inline on download endpoints in github.com/turt2live/matrix-media-repo
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/turt2live/matrix-media-repo
Introduced in:
0Fixed in: 1.3.0Fix
go get github.com/turt2live/matrix-media-repo@v1.3.0References
- https://github.com/turt2live/matrix-media-repo/security/advisories/GHSA-5crw-6j7v-xc72[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2023-41318[ADVISORY]
- https://github.com/turt2live/matrix-media-repo/commit/77ec2354e8f46d5ef149d1dcaf25f51c04149137[FIX]
- https://github.com/turt2live/matrix-media-repo/commit/bf8abdd7a5371118e280c65a8e0ec2b2e9bdaf59[FIX]
- https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script[WEB]