Element Web
Monthly
Element Web's EmbeddedPage component rendered homeserver-supplied homepage HTML directly into the DOM via React's dangerouslySetInnerHTML without first passing it through the application's sanitizedHtmlNode utility, enabling any malicious or compromised Matrix homeserver to inject arbitrary HTML into the client homepage of connecting users prior to version 1.12.22. The Content Security Policy blocks JavaScript execution, constraining impact to HTML-based phishing - fake login forms, spoofed UI overlays - rather than remote code execution. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Element Web's EmbeddedPage component rendered homeserver-supplied homepage HTML directly into the DOM via React's dangerouslySetInnerHTML without first passing it through the application's sanitizedHtmlNode utility, enabling any malicious or compromised Matrix homeserver to inject arbitrary HTML into the client homepage of connecting users prior to version 1.12.22. The Content Security Policy blocks JavaScript execution, constraining impact to HTML-based phishing - fake login forms, spoofed UI overlays - rather than remote code execution. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.