CVE-2023-30609
matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.
- Record
CVE-2023-30609- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L - Weakness
- CWE-74
- Updated
- 2026-11-02
EUVDEUVD-2023-1433
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.
- Record
EUVD-2023-1433- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xv83-x443-7rmw
HTML injection in search results via plaintext message highlighting
Impact
Plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload.
Cross-site scripting is possible by including resources from recaptcha.net and gstatic.com which are included in the default CSP.
Thanks to Cadence Ember for finding the injection and to S1m for finding possible XSS vectors.
Patches
Version 3.71.0 of the SDK fixes the issue.
Workarounds
Restarting the client will clear the injection.
- Record
GHSA-xv83-x443-7rmw- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - Weakness
- CWE-74, CWE-79
- Updated
- 2026-11-02
NVD
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.
- Record
CVE-2023-30609- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L - CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
OSVALPINE-CVE-2023-30609
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.
- Record
ALPINE-CVE-2023-30609- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - Updated
- 2026-11-03
OSV
matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.
- Record
CVE-2023-30609- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L - Weakness
- CWE-74
- Updated
- 2026-11-02
OSVGHSA-xv83-x443-7rmw
HTML injection in search results via plaintext message highlighting
Impact
Plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload.
Cross-site scripting is possible by including resources from recaptcha.net and gstatic.com which are included in the default CSP.
Thanks to Cadence Ember for finding the injection and to S1m for finding possible XSS vectors.
Patches
Version 3.71.0 of the SDK fixes the issue.
Workarounds
Restarting the client will clear the injection.
- Record
GHSA-xv83-x443-7rmw- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - Weakness
- CWE-74, CWE-79
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12884-1 No score
element-web-1.11.30-1.1 on GA media
These are all security issues fixed in the element-web-1.11.30-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12884-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12895-1 No score
element-desktop-1.11.30-1.1 on GA media
These are all security issues fixed in the element-desktop-1.11.30-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12895-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
matrix-react-sdknpm |
before 3.71.0 | 3.71.0 |
element-webAlpine:v3.18 |
before 1.11.30-r0 | 1.11.30-r0 |
element-webAlpine:v3.19 |
before 1.11.30-r0 | 1.11.30-r0 |
element-webAlpine:v3.20 |
before 1.11.30-r0 | 1.11.30-r0 |
element-webAlpine:v3.21 |
before 1.11.30-r0 | 1.11.30-r0 |
element-webAlpine:v3.22 |
before 1.11.30-r0 | 1.11.30-r0 |
element-webAlpine:v3.23 |
before 1.11.30-r0 | 1.11.30-r0 |
element-webAlpine:v3.24 |
before 1.11.30-r0 | 1.11.30-r0 |
riot-webAlpine:v3.17 |
before 1.11.30-r0 | 1.11.30-r0 |
element-webopenSUSE:Tumbleweed |
before 1.11.30-1.1 | 1.11.30-1.1 |
element-desktopopenSUSE:Tumbleweed |
before 1.11.30-1.1 | 1.11.30-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-30609 is a medium vulnerability (CVSS 5.4) in Matrix-org Matrix-react-sdk, published April 25, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 49th percentile. Fixed in matrix-react-sdk 3.71.0.
References
github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-xv83-x443-7rmw
nvd.nist.gov/vuln/detail/CVE-2023-30609
security.alpinelinux.org/vuln/CVE-2023-30609
suse.com/security/cve/CVE-2023-30609