Most recent entries from all

CLEANSTART-2024-ZD82819 — matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page

2026-10-05T21:14:43.157460+00:00

Affected: CleanStart: element-web

Security vulnerability affects the element-web package. matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page.

EUVD-2026-213228

2026-10-05T21:14:43.157506+00:00

EUVD-2026-213228

fkie_cve-2023-30609

2026-10-05T21:14:43.157523+00:00

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.

GHSA-xv83-x443-7rmw — HTML injection in search results via plaintext message highlighting

2026-10-05T21:14:43.157548+00:00

Affected: npm: matrix-react-sdk

### Impact Plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload.

Cross-site scripting is possible by including resources from `recaptcha.net` and `gstatic.com` which are included in the default CSP.

Thanks to [Cadence Ember](https://cadence.moe/) for finding the injection and to [S1m](https://github.com/p1gp1g/) for finding possible XSS vectors.

### Patches Version 3.71.0 of the SDK fixes the issue.

### Workarounds Restarting the client will clear the injection.

gsd-2023-30609

2026-10-05T21:14:43.157574+00:00

gsd-2023-30609

openSUSE-SU-2024:12884-1 — element-web-1.11.30-1.1 on GA media

2026-10-05T21:14:43.157586+00:00

element-web-1.11.30-1.1 on GA media