CVE-2026-55850: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in element-hq element-web
Element Web versions prior to 1.12.22 contain a cross-site scripting (XSS) vulnerability due to improper sanitization of homeserver-supplied homepage content. The EmbeddedPage component renders this content using dangerouslySetInnerHTML without sanitizing it, allowing malicious HTML to be displayed. Although the content security policy blocks JavaScript execution, phishing HTML content can still be rendered. This vulnerability is fixed in version 1.12.22.
AI Analysis
Technical Summary
Element Web, a Matrix web client, had an XSS vulnerability (CWE-79) in the EmbeddedPage component prior to version 1.12.22. The component rendered homeserver-supplied homepage HTML content using React's dangerouslySetInnerHTML without sanitizing it via sanitizedHtmlNode. This allowed a malicious homeserver to supply crafted HTML that could be rendered on the homepage. The content security policy prevents JavaScript execution, mitigating script-based attacks, but does not prevent phishing HTML content from being displayed. The issue was addressed and fixed in version 1.12.22.
Potential Impact
An attacker controlling a malicious homeserver can supply crafted HTML content that is rendered on the Element Web homepage. While JavaScript execution is blocked by the content security policy, the vulnerability allows phishing-style HTML content to be displayed, potentially misleading users. This could facilitate social engineering attacks but does not allow direct script execution or code injection.
Mitigation Recommendations
This vulnerability is fixed in Element Web version 1.12.22. Users and administrators should upgrade to version 1.12.22 or later to remediate this issue. No other official remediation or temporary fixes are documented. Patch status is not explicitly confirmed in the vendor advisory, but the description states the issue is fixed in 1.12.22.
CVE-2026-55850: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in element-hq element-web
Description
Element Web versions prior to 1.12.22 contain a cross-site scripting (XSS) vulnerability due to improper sanitization of homeserver-supplied homepage content. The EmbeddedPage component renders this content using dangerouslySetInnerHTML without sanitizing it, allowing malicious HTML to be displayed. Although the content security policy blocks JavaScript execution, phishing HTML content can still be rendered. This vulnerability is fixed in version 1.12.22.
CVSS v4.0
Score 5.3medium
Affected software
pkg:github/element-hq/element-webRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Element Web, a Matrix web client, had an XSS vulnerability (CWE-79) in the EmbeddedPage component prior to version 1.12.22. The component rendered homeserver-supplied homepage HTML content using React's dangerouslySetInnerHTML without sanitizing it via sanitizedHtmlNode. This allowed a malicious homeserver to supply crafted HTML that could be rendered on the homepage. The content security policy prevents JavaScript execution, mitigating script-based attacks, but does not prevent phishing HTML content from being displayed. The issue was addressed and fixed in version 1.12.22.
Potential Impact
An attacker controlling a malicious homeserver can supply crafted HTML content that is rendered on the Element Web homepage. While JavaScript execution is blocked by the content security policy, the vulnerability allows phishing-style HTML content to be displayed, potentially misleading users. This could facilitate social engineering attacks but does not allow direct script execution or code injection.
Mitigation Recommendations
This vulnerability is fixed in Element Web version 1.12.22. Users and administrators should upgrade to version 1.12.22 or later to remediate this issue. No other official remediation or temporary fixes are documented. Patch status is not explicitly confirmed in the vendor advisory, but the description states the issue is fixed in 1.12.22.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-17T16:44:40.994Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a889e77acd9273b498fc1fd
Added to database: 08/21/2026, 18:52:39 UTC
Last enriched: 08/21/2026, 19:07:33 UTC
Last updated: 08/21/2026, 19:29:35 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.