CVE-2023-37259: matrix-react-sdk vulnerable to XSS in Export Chat feature
Summary
CVE-2023-37259: matrix-react-sdk vulnerable to XSS in Export Chat feature. Affects matrix-react-sdk versions >= 3.32.0, < 3.76.0. Fixed in 3.76.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
matrix-react-sdk is an npm package that provides a React SDK for building Matrix clients. It is used to create web applications that interact with the Matrix communication protocol. The Export Chat feature in matrix-react-sdk allows users to export chat conversations into a separate document. However, this feature is vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The Export Chat feature in matrix-react-sdk fails to properly escape certain attacker-controlled elements in the generated document, leading to a stored XSS vulnerability. This means that an attacker can inject malicious code into the exported chat document, which can then be executed by unsuspecting users who open the document. While the impact of this vulnerability is limited because the injected code can only run from the null origin, it still allows an attacker to potentially leak message contents. A malicious homeserver can exploit this vulnerability since the affected inputs are controllable server-side.
How To Fix
Latest published version: 3.114.0 as of 23 Oct 2026
npm install matrix-react-sdk@3.114.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.76.0
This is the first release that contains the fix.
npm install matrix-react-sdk@3.76.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
The only workaround for this vulnerability is to avoid using the Export Chat feature in matrix-react-sdk.
Conclusion
The Export Chat feature in matrix-react-sdk is vulnerable to a stored XSS attack. It is recommended to update to the latest version of matrix-react-sdk to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for matrix-react-sdk →
FAQ
matrix-react-sdk is an npm package that provides a React SDK for building Matrix clients. It is used to create web applications that interact with the Matrix communication protocol.
The Export Chat feature in matrix-react-sdk allows users to export chat conversations into a separate document.
Stored cross-site scripting (XSS) is a type of XSS attack where the malicious code is permanently stored on the target server and served to users who access the vulnerable application.
The impact of this vulnerability is limited because the injected code can only run from the null origin. However, it still allows an attacker to potentially leak message contents.
To fix this vulnerability, update your matrix-react-sdk package to version 3.76.0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-react-sdk.
