CVE-2026-55850

Element Web (a Matrix web client) prior to 1.12.22 is vulnerable to HTML injection via the EmbeddedPage component (apps/web/src/components/structures/EmbeddedPage.tsx). The component renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedH...

EUVD-2026-64046

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...

PT-2026-79429

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...