Read the docs
TI-2023-14425 Aliases CVE-2023-30609GHSA-xv83-x443-7rmw

matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting

Priority LOW 25CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00617 49th percentileScored 2026-11-07
Fix Fixed matrix-react-sdk (matrix-org): 3.71.0matrix-react-sdk (npm): 3.71.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
matrix-orgmatrix-react-sdkbefore 3.71.03.71.0Patch availableCNA
—matrix-react-sdk (npm)before 3.71.03.71.0Patch availableGHSA-xv83-x443-7rmw
  • matrix-react-sdk Vendormatrix-org Affected before 3.71.0 Fixed in 3.71.0 Patch available CNA
  • matrix-react-sdk (npm) Vendor— Affected before 3.71.0 Fixed in 3.71.0 Patch available GHSA-xv83-x443-7rmw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:matrix-react-sdk_project:matrix-react-sdk:*:*:*:*:*:node.js:*:*before 3.71.0VulnerableMatrix-react-sdk Project
  • cpe:2.3:a:matrix-react-sdk_project:matrix-react-sdk:*:*:*:*:*:node.js:*:* Versions before 3.71.0 Vulnerable ·Matrix-react-sdk Project

Remediation

  • Fix · CNA matrix-react-sdk (matrix-org) Fixed in 3.71.0
  • Fix · GHSA-xv83-x443-7rmw matrix-react-sdk (npm) Fixed in 3.71.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-30609
  2. 2026-10-03 Alias added: GHSA-xv83-x443-7rmw

References

Patch 1

Advisory 2

Other 2

  • TI-2023-20035 Sydent does not verify email server certificates CVSS 3.1CRITICAL 9.3
  • TI-2026-45046 Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint CVSS 4.0MEDIUM 6.9
  • TI-2026-45045 Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint CVSS 4.0HIGH 7.1
  • TI-2026-45047 Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure CVSS 4.0MEDIUM 5.3
  • TI-2023-15617 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites CVSS 3.1MEDIUM 5.0
  • TI-2023-20039 matrix-appservice-irc IRC command injection via admin commands containing newlines CVSS 3.1CRITICAL 9.8
See all 115 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences