Skip to content
OpenAdvisories

Product · element-hq

element-web

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-55850

    Element Web: A malicious homeserver can inject HTML in Element Web using its homepage

    Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through …

    element-hq element-web
  • Medium 5.0
    CVE-2024-51750

    Element allows a malicious homeserver can modify events leading to unrenderable events or rooms

    Element is a Matrix web client built using the Matrix React SDK. A malicious homeserver can send invalid messages over federation which can prevent Element Web and Desktop from rendering single messages or the entire room containing them. This was patched in …

    element-hq element-web