https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 22:54:53 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-196430 EUVD-2026-196430 https://cve.radiocsirt.org/vuln/euvd-2026-196430 https://cve.radiocsirt.org/vuln/fkie_cve-2023-37259 <p>matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting (XSS). Since the Export Chat feature generates a separate document, an attacker can only inject code run from the `null` origin, restricting the impact. However, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side. This issue has been addressed in commit `22fcd34c60` which is included in release version 3.76.0. Users are advised to upgrade. The only known workaround for this issue is to disable or to not use the Export Chat feature.</p> <p>matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting (XSS). Since the Export Chat feature generates a separate document, an attacker can only inject code run from the `null` origin, restricting the impact. However, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side. This issue has been addressed in commit `22fcd34c60` which is included in release version 3.76.0. Users are advised to upgrade. The only known workaround for this issue is to disable or to not use the Export Chat feature.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-37259 https://cve.radiocsirt.org/vuln/ghsa-c9vx-2g7w-rp65 <p><strong>Affected:</strong> npm: matrix-react-sdk</p> <p>### Description</p> <p>The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored XSS.</p> <p>### Impact</p> <p>Since the Export Chat feature generates a separate document, an attacker can only inject code run from the `null` origin, restricting the impact.</p> <p>However, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side.</p> <p>### Patches This was patched in matrix-react-sdk 3.76.0.</p> <p>### Workarounds None, other than not using the Export Chat feature.</p> <p>### References N/A</p> <p><strong>Affected:</strong> npm: matrix-react-sdk</p> <p>### Description</p> <p>The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored XSS.</p> <p>### Impact</p> <p>Since the Export Chat feature generates a separate document, an attacker can only inject code run from the `null` origin, restricting the impact.</p> <p>However, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side.</p> <p>### Patches This was patched in matrix-react-sdk 3.76.0.</p> <p>### Workarounds None, other than not using the Export Chat feature.</p> <p>### References N/A</p> https://cve.radiocsirt.org/vuln/ghsa-c9vx-2g7w-rp65 https://cve.radiocsirt.org/vuln/gsd-2023-37259 gsd-2023-37259 https://cve.radiocsirt.org/vuln/gsd-2023-37259 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13054-1 <p>element-desktop-1.11.36-1.1 on GA media</p> <p>element-desktop-1.11.36-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:13054-1