https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 21:14:37 +0000 https://cve.radiocsirt.org/vuln/cleanstart-2024-zd82819 <p><strong>Affected:</strong> CleanStart: element-web</p> <p>Security vulnerability affects the element-web package. matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page.</p> <p><strong>Affected:</strong> CleanStart: element-web</p> <p>Security vulnerability affects the element-web package. matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page.</p> https://cve.radiocsirt.org/vuln/cleanstart-2024-zd82819 https://cve.radiocsirt.org/vuln/euvd-2026-213228 EUVD-2026-213228 https://cve.radiocsirt.org/vuln/euvd-2026-213228 https://cve.radiocsirt.org/vuln/fkie_cve-2023-30609 <p>matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.</p> <p>matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-30609 https://cve.radiocsirt.org/vuln/ghsa-xv83-x443-7rmw <p><strong>Affected:</strong> npm: matrix-react-sdk</p> <p>### Impact Plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload.</p> <p>Cross-site scripting is possible by including resources from `recaptcha.net` and `gstatic.com` which are included in the default CSP.</p> <p>Thanks to [Cadence Ember](https://cadence.moe/) for finding the injection and to [S1m](https://github.com/p1gp1g/) for finding possible XSS vectors.</p> <p>### Patches Version 3.71.0 of the SDK fixes the issue.</p> <p>### Workarounds Restarting the client will clear the injection.</p> <p><strong>Affected:</strong> npm: matrix-react-sdk</p> <p>### Impact Plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload.</p> <p>Cross-site scripting is possible by including resources from `recaptcha.net` and `gstatic.com` which are included in the default CSP.</p> <p>Thanks to [Cadence Ember](https://cadence.moe/) for finding the injection and to [S1m](https://github.com/p1gp1g/) for finding possible XSS vectors.</p> <p>### Patches Version 3.71.0 of the SDK fixes the issue.</p> <p>### Workarounds Restarting the client will clear the injection.</p> https://cve.radiocsirt.org/vuln/ghsa-xv83-x443-7rmw https://cve.radiocsirt.org/vuln/gsd-2023-30609 gsd-2023-30609 https://cve.radiocsirt.org/vuln/gsd-2023-30609 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12884-1 <p>element-web-1.11.30-1.1 on GA media</p> <p>element-web-1.11.30-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:12884-1