CVE-2023-30609: HTML Injection in matrix-react-sdk
Summary
CVE-2023-30609: HTML injection in search results via plaintext message highlighting. Affects matrix-react-sdk versions < 3.71.0. Fixed in 3.71.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
matrix-react-sdk is an npm package that provides a software development kit (SDK) for building Matrix clients using React. It enables developers to create web applications that can communicate with the Matrix decentralized communication protocol. The package is widely used and allows users to search for messages within the Matrix client. However, a vulnerability has been discovered in the package that allows for HTML injection in search results.
Vulnerability Detail
The vulnerability in matrix-react-sdk allows plain text messages containing HTML tags to be rendered as HTML in the search results. An attacker can exploit this by tricking a user into searching for a specific message that contains an HTML injection payload. Although the content security policy prevents cross-site scripting attacks, this vulnerability still poses a risk. The impact of this vulnerability is moderate, as it requires user interaction to be exploited. The vulnerability has a CVSS score of 5.4.
How To Fix
Latest published version: 3.114.0 as of 23 Oct 2026
npm install matrix-react-sdk@3.114.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.71.0
This is the first release that contains the fix.
npm install matrix-react-sdk@3.71.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately possible, a temporary workaround is to restart the client. This will clear any HTML injection that may have occurred in the search results.
Conclusion
The matrix-react-sdk package is vulnerable to HTML injection in search results. Users should update to version 3.71.0 of the package to fix this vulnerability. If immediate updating is not possible, restarting the client can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for matrix-react-sdk →
FAQ
matrix-react-sdk is an npm package that provides an SDK for building Matrix clients using React.
The impact of this vulnerability is moderate, as it requires user interaction to be exploited. However, it can allow for HTML injection in search results.
An attacker can exploit this vulnerability by tricking a user into searching for a specific message that contains an HTML injection payload.
Yes, users can fix this vulnerability by updating to version 3.71.0 of the matrix-react-sdk package.
A temporary workaround is to restart the client, which will clear any HTML injection that may have occurred in the search results.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-react-sdk.
