Skip to content
OpenAdvisories

Package · npm

cinny

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 7.1
    CVE-2026-42553

    Cinny: Access token disclosure via invalidated emoji pack avatar URL in service worker

    Cinny is a Matrix client. Prior to 4.10.3, A remote authenticated attacker who shares a room with a victim and has permissions to create room emotes (for example in a DM) can cause the victim's client to send their Matrix access token to an attacker-controlle…

    cinnyapp cinny cinny npm