How severe is GHSA-wchh-9x6h-7f6p?

No CVSS score has been assigned to GHSA-wchh-9x6h-7f6p yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-wchh-9x6h-7f6p?

GHSA-wchh-9x6h-7f6p affects the following packages: matrix-commander (PyPI). Ecosystems affected: PyPI.

How do I fix GHSA-wchh-9x6h-7f6p?

No patched version of matrix-commander has shipped for GHSA-wchh-9x6h-7f6p yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.

How do I detect GHSA-wchh-9x6h-7f6p in my PyPI dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for matrix-commander, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-wchh-9x6h-7f6p if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is GHSA-wchh-9x6h-7f6p actively exploited in the wild?

No public exploit code has been indexed for GHSA-wchh-9x6h-7f6p yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-wchh-9x6h-7f6p published, and has it been updated?

GHSA-wchh-9x6h-7f6p was published on July 29, 2026 and was last updated on July 29, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐍 PyPI

Not in CISA KEV

olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193GHSA-wchh-9x6h-7f6p

Fix: matrix-nio/matrix-nio#555

GHSA-wchh-9x6h-7f6p is a security vulnerability in matrix-commander. No vendor fix is recorded yet; mitigation options are listed below.

Published

Jul 29, 2026

Updated

Jul 29, 2026

Affected

1 pkg

Patched

See advisory

Exploits

None indexed

Exploitation data as of Jul 29, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

🐍matrix-commander

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Problem

Multiple vulnerabilities were disclosed in 2024 affecting libolm (Olm): AES timing / side‑channel, Ed25519 signature malleability, and timing leaks in base64 decoding; several CVEs were assigned. Patches and mitigations were published; maintainers recommend upgrading to fixed versions. In addition, a 2022 “Olm/Megolm protocol confusion” advisory affecting some SDKs was critical and required client-side fixes. Use patched versions of libolm and up-to-date Matrix SDKs; avoid unpatched clients/servers.

Olm is a dependency of matrix-commander (Python version, not Rust version).

WARNING:

Due to cryptographic olm dependency deprecation, this program is cryptographically unsafe to use until https://github.com/matrix-nio/matrix-nio/pull/555 is merged. Good news: https://github.com/8go/matrix-commander-rs is a Rust alternative not having this issue.

References

Workarounds

use the Rust version: https://github.com/8go/matrix-commander-rs

Severity:

Medium

CVE-2022-39255 — MEDIUM (NVD/MITRE lists CVSS base score 5.x — treated as Medium).

CVE-2024-45193 — MEDIUM (NVD shows CVSS 3.1 base score ~4.3 — Medium)

Affected Packages

1 total

Ecosystem	Package	Vulnerable range	Fix
🐍PyPI	`matrix-commander`	all versions	No fix

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for matrix-commander, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
No patched version of matrix-commander has shipped for GHSA-wchh-9x6h-7f6p yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Problem Multiple vulnerabilities were disclosed in 2024 affecting libolm (Olm): AES timing / side‑channel, Ed25519 signature malleability, and timing leaks in base64 decoding; several CVEs were assigned. Patches and mitigations were published; maintainers recommend upgrading to fixed versions. In addition, a 2022 “Olm/Megolm protocol confusion” advisory affecting some SDKs was critical and required client-side fixes. Use patched versions of libolm and up-to-date Matrix SDKs; avoid unpatched clients/servers. Olm is a dependency of `matrix-commander` (Python version, not Rust version). WA

O3 Security · Impact-Aware SCA

Is GHSA-wchh-9x6h-7f6p in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works