CVE-2025-23197: Matrix-Org Matrix-Hookshot

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. When Hookshot 6 version 6.0.1 or below, or Hookshot 5 version 5.4.1 or below, is configured with GitHub support, it is vulnerable to a Denial of Service (DoS) whereby it can crash on restart due to a missing check. The impact is greater to you untrusted users can add their own GitHub organizations to Hookshot in order to connect their room to a repository. This vulnerability is fixed in 6.0.2 and 5.4.2.

Affected products

• Matrix-Org Matrix-Hookshot: from 6.0.0, before 6.0.2 (fixed in 6.0.2); before 5.4.2 (fixed in 5.4.2)

Published 2025-01-27. Last modified 2026-06-17.