Skip to content
OpenAdvisories

Package · npm

matrix-react-sdk

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.1
    CVE-2023-37259

    Cross site scripting in Export Chat feature

    matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting …

    matrix-org matrix-react-sdk matrix-react-sdk npm
  • Medium 5.4
    CVE-2023-30609

    matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting

    matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user int…

    matrix-org matrix-react-sdk riot-web element-web Alpine npm
  • Medium 4.2
    CVE-2021-32622

    File upload local preview can run embedded scripts after user interaction

    Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after sever…

    matrix-org matrix-react-sdk matrix-react-sdk npm