Element Web
Monthly
Element Web and Element Desktop 1.12.31 and earlier will silently log out a logged-in user who opens a link whose URL fragment carries both guest_user_id and guest_access_token, because loadSession adopted those attacker-supplied guest credentials and cleared local stores. The practical consequence is loss of unbacked end-to-end encryption keys and, where no secure backup exists, of the user's digital identity; users with secure backup enabled can recover keys, reducing the outcome to a forced logout. Exploitation requires the victim to already be signed in and to click a crafted link - there is no zero-click path - and version 1.12.32 fixes it; no public exploit code has been confirmed, though the advisory and a research write-up describe the mechanism.
Element Web's EmbeddedPage component rendered homeserver-supplied homepage HTML directly into the DOM via React's dangerouslySetInnerHTML without first passing it through the application's sanitizedHtmlNode utility, enabling any malicious or compromised Matrix homeserver to inject arbitrary HTML into the client homepage of connecting users prior to version 1.12.22. The Content Security Policy blocks JavaScript execution, constraining impact to HTML-based phishing - fake login forms, spoofed UI overlays - rather than remote code execution. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Element Web and Element Desktop 1.12.31 and earlier will silently log out a logged-in user who opens a link whose URL fragment carries both guest_user_id and guest_access_token, because loadSession adopted those attacker-supplied guest credentials and cleared local stores. The practical consequence is loss of unbacked end-to-end encryption keys and, where no secure backup exists, of the user's digital identity; users with secure backup enabled can recover keys, reducing the outcome to a forced logout. Exploitation requires the victim to already be signed in and to click a crafted link - there is no zero-click path - and version 1.12.32 fixes it; no public exploit code has been confirmed, though the advisory and a research write-up describe the mechanism.
Element Web's EmbeddedPage component rendered homeserver-supplied homepage HTML directly into the DOM via React's dangerouslySetInnerHTML without first passing it through the application's sanitizedHtmlNode utility, enabling any malicious or compromised Matrix homeserver to inject arbitrary HTML into the client homepage of connecting users prior to version 1.12.22. The Content Security Policy blocks JavaScript execution, constraining impact to HTML-based phishing - fake login forms, spoofed UI overlays - rather than remote code execution. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.