CVE-2023-30609

    Dashboard / Vulnerabilities / CVE-2023-30609

    CVE-2023-30609

    Published: 25 Apr 2023Last Modified: 12 Aug 2026

    Summary: matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting

    Details: matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.

    References: https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.71.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30609.json, https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-xv83-x443-7rmw, https://nvd.nist.gov/vuln/detail/CVE-2023-30609, https://github.com/matrix-org/matrix-react-sdk/commit/bf182bc94556849d7acdfa0e5fdea2aa129ea826

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -3992c97fe22aaf7882f132ed8ee178b0a408a09b

    Affected versions

    v3.71.0-rc.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-30609 | CVE-DB