How severe is CVE-2023-43656?

CVE-2023-43656 has a CVSS 3.x base score of 5.6, rated medium severity. It is exploitable over local access with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.

Is CVE-2023-43656 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-43656?

CVE-2023-43656 affects Matrix Hookshot. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-43656?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-43656 published?

CVE-2023-43656 was published on 2023-09-27 and last updated on 2026-06-17.

CVE-2023-43656

CVE-2023-43656 is a medium-severity vulnerability in Matrix Hookshot with a CVSS 3.x base score of 5.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-74.

Key facts

Severity: Medium (CVSS 3.x base score 5.6)
EPSS exploit prediction: 0% (20th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-74
Affected product: Matrix Hookshot
Published: 2023-09-27
Last modified: 2026-06-17

Description

matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation functions (those that have `generic.allowJsTransformationFunctions` in their config), may be vulnerable to an attack where it is possible to break out of the `vm2` sandbox and as a result Hookshot will be vulnerable to this. This problem is only likely to affect users who have allowed untrusted users to apply their own transformation functions. If you have only enabled a limited set of trusted users, this threat is reduced (though not eliminated). Version 4.5.0 and above of hookshot include a new sandbox library which should better protect users. Users are advised to upgrade. Users unable to upgrade should disable `generic.allowJsTransformationFunctions` in the config.

Frequently asked questions

What is CVE-2023-43656?: matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. Instances that have enabled transformation functions (those that have `generic.allowJsTransformationFunctions` in their config), may be vulnerable to an attack where it is possible to break out of the `vm2` sandbox and as a result Hookshot will be vulnerable to this. This problem is only likely to affect users who have allowed untrusted users to apply their own transformation functions. If you have only enabled a limited set of trusted users, this threat is reduced (though not eliminated). Version 4.5.0 and above of hookshot include a new sandbox library which should better protect users. Users are advised to upgrade. Users unable to upgrade should disable `generic.allowJsTransformationFunctions` in the config.
How severe is CVE-2023-43656?: CVE-2023-43656 has a CVSS 3.x base score of 5.6, rated medium severity. It is exploitable over local access with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.
Is CVE-2023-43656 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-43656?: CVE-2023-43656 affects Matrix Hookshot. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-43656?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-43656 published?: CVE-2023-43656 was published on 2023-09-27 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:matrix:hookshot:*:*:*:*:*:*:*:*

Other CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities

CVE-2026-25586 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty…
CVE-2026-25520 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped.…
CVE-2025-20265 — Critical (CVSS 10.0): A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could…
CVE-2025-20337 — Critical (CVSS 10.0): A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
CVE-2025-20281 — Critical (CVSS 10.0): A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
CVE-2024-42472 — Critical (CVSS 10.0): Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious…

Browse all CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities →