matrix-org matrix-hookshot vulnerabilities

Latest matrix-org matrix-hookshot CVEs

Newest publication first

1. CVE-2025-23197 matrix-hookshot has a Potential Denial of Service when Hookshot is configured with GitHub support

   Published 2025-01-27

   Medium·CVSS 6.5 EPSS 0.47%

   matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. When Hookshot 6 version 6.0.1 or below, or Hookshot 5 version 5.4.1 or below, is configured with GitHub support, it is vulnerable to a Denial of Service (DoS) whereby it can c...

2. CVE-2023-43656 Sandbox escape for instances that have enabled transformation functions in matrix-hookshot

   Published 2023-09-27

   Critical·CVSS 9.0 EPSS 0.32%

   matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation functions (those that have generic.allowJsTransformationFunctions in their config), may be vulnerable to an attack where it is possi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.