{"id":"CVE-2023-37259","aliases":["EUVD-2023-2027","GHSA-c9vx-2g7w-rp65","openSUSE-SU-2024:13054-1","openSUSE-SU-2024:13055-1"],"status":"published","title":"Cross site scripting in Export Chat feature","description":"matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting (XSS). Since the Export Chat feature generates a separate document, an attacker can only inject code run from the `null` origin, restricting the impact. However, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side. This issue has been addressed in commit `22fcd34c60` which is included in release version 3.76.0. Users are advised to upgrade. The only known workaround for this issue is to disable or to not use the Export Chat feature.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00452,"percentile":0.39551,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79","CWE-80"],"published":"2023-07-18T16:58:01Z","modified":"2026-10-28T02:31:04Z","fixes":[{"ecosystem":"npm","package":"matrix-react-sdk","fixed_in":["3.76.0"],"sources":["ghsa","osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"element-desktop","fixed_in":["1.11.36-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"element-web","fixed_in":["1.11.36-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"matrix-react-sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.32.0"},{"fixed":"3.76.0"}]}]},{"source":"osv","ecosystem":"npm","package":"matrix-react-sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"3.32.0"},{"fixed":"3.76.0"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"element-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.36-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"element-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.36-1.1"}]}]}],"products":[{"vendor":"matrix-org","product":"matrix-react-sdk"},{"vendor":"matrix-react-sdk_project","product":"matrix-react-sdk"}],"references":[{"url":"https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-c9vx-2g7w-rp65","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/matrix-org/matrix-react-sdk/commit/22fcd34c606f32129ebc967fc21f24fb708a98b8","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.76.0","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37259","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c9vx-2g7w-rp65"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37259.json","tags":["advisory"]},{"url":"https://github.com/matrix-org/matrix-react-sdk","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-37259","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-37259","title":"Cross site scripting in Export Chat feature","description":"matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting (XSS). Since the Export Chat feature generates a separate document, an attacker can only inject code run from the `null` origin, restricting the impact. However, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side. This issue has been addressed in commit `22fcd34c60` which is included in release version 3.76.0. Users are advised to upgrade. The only known workaround for this issue is to disable or to not use the Export Chat feature.","status":"published","published":"2023-07-18T16:59:21.659Z","modified":"2024-10-18T17:24:35.91Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:16.454633Z"}],"euvd":[{"id":"EUVD-2023-2027","description":"matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting (XSS). Since the Export Chat feature generates a separate document, an attacker can only inject code run from the `null` origin, restricting the impact. However, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side. This issue has been addressed in commit `22fcd34c60` which is included in release version 3.76.0. Users are advised to upgrade. The only known workaround for this issue is to disable or to not use the Export Chat feature.","status":"published","published":"2023-07-18T16:59:21Z","modified":"2024-10-18T17:24:35Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:27:32.691525Z"}],"ghsa":[{"id":"GHSA-c9vx-2g7w-rp65","title":"matrix-react-sdk vulnerable to XSS in Export Chat feature","description":"### Description\n\nThe Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored XSS.\n\n### Impact\n\nSince the Export Chat feature generates a separate document, an attacker can only inject code run from the `null` origin, restricting the impact.\n\nHowever, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side.\n\n### Patches\nThis was patched in matrix-react-sdk 3.76.0.\n\n### Workarounds\nNone, other than not using the Export Chat feature.\n\n### References\nN/A\n","status":"published","published":"2023-07-18T16:58:01Z","modified":"2023-11-06T05:03:20Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T14:37:14.234712Z"}],"nvd":[{"id":"CVE-2023-37259","description":"matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting (XSS). Since the Export Chat feature generates a separate document, an attacker can only inject code run from the `null` origin, restricting the impact. However, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side. This issue has been addressed in commit `22fcd34c60` which is included in release version 3.76.0. Users are advised to upgrade. The only known workaround for this issue is to disable or to not use the Export Chat feature.","status":"published","published":"2023-07-18T17:15:11.49Z","modified":"2026-06-17T06:07:50.04Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:17.044696Z"}],"osv":[{"id":"CVE-2023-37259","title":"Cross site scripting in Export Chat feature","description":"matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting (XSS). Since the Export Chat feature generates a separate document, an attacker can only inject code run from the `null` origin, restricting the impact. However, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side. This issue has been addressed in commit `22fcd34c60` which is included in release version 3.76.0. Users are advised to upgrade. The only known workaround for this issue is to disable or to not use the Export Chat feature.","status":"published","published":"2023-07-18T16:59:21.659Z","modified":"2026-10-28T02:31:04.203292801Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:32.510144Z"},{"id":"GHSA-c9vx-2g7w-rp65","title":"matrix-react-sdk vulnerable to XSS in Export Chat feature","description":"### Description\n\nThe Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored XSS.\n\n### Impact\n\nSince the Export Chat feature generates a separate document, an attacker can only inject code run from the `null` origin, restricting the impact.\n\nHowever, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side.\n\n### Patches\nThis was patched in matrix-react-sdk 3.76.0.\n\n### Workarounds\nNone, other than not using the Export Chat feature.\n\n### References\nN/A\n","status":"published","published":"2023-07-18T16:58:01Z","modified":"2023-11-08T04:13:00.301912Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"openSUSE-SU-2024:13054-1","title":"element-desktop-1.11.36-1.1 on GA media","description":"These are all security issues fixed in the element-desktop-1.11.36-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:01:19.56839Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:13055-1","title":"element-web-1.11.36-1.1 on GA media","description":"These are all security issues fixed in the element-web-1.11.36-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:27:09.247382Z","updated_at":"2026-11-02T16:58:36.025801Z"}]}}