CVE-2022-22763

What it actually does

Race condition allows script execution after worker shutdown point where it should be impossible, enabling code to run in an invalid lifecycle state.

Why it matters to the business

Attackers could execute unauthorized code in affected applications, potentially leading to data compromise or service disruption; low EPSS and no known exploitation reduce immediate urgency despite high CVSS.

How an attack unfolds

An attacker crafts input that triggers worker shutdown while simultaneously scheduling script execution, exploiting the timing window to run code after the intended cutoff, though no public exploits or threat actors are associated.

How to fix it

Upgrade matrix-org/dendrite (GIT) to commit 2792d0490f3771488bad346981b8c26479a872c3 or later; apply equivalent patches for Firefox < 96, Thunderbird < 91.6, and Firefox ESR < 91.6.

How to confirm the fix worked

Confirm upgrade to fixed commit or version; test worker shutdown paths to ensure no late script execution is possible; review changelogs for race condition fixes.

Typical attack path

1. Identify target running vulnerable version of affected software
2. Trigger worker shutdown sequence via crafted request or interaction
3. Race to inject or schedule script execution during shutdown window
4. Execute arbitrary code in post-shutdown context for impact

How to detect it

Review application logs for unexpected script activity during worker termination events; inspect process traces or audit logs around shutdown timestamps for anomalies.

What your security team should do

• Prioritize upgrade of matrix-org/dendrite to the specified fixed commit
• Monitor EPSS trend for any increase indicating rising exploit likelihood
• Scan environments for presence of listed vulnerable versions
• Implement timing-resistant shutdown handling if custom workers are used