CVE-2023-30609

The CVE-2023-30609 issue affects matrix-react-sdk prior to version 3.71.0, where plain text messages containing HTML tags rendered in search results are treated as HTML. Exploitation requires tricking a user into searching for a specific message containing an HTML payload; the vulnerability is mi...

CVE-2023-28103

CVE-2023-28103 affects matrix-react-sdk (Matrix JS/React SDK). In certain configurations, data from remote servers containing special strings in key locations could cause prototype pollution by modifying Object.prototype, disrupting sdk functionality and potentially causing denial of service or l...

CVE-2023-37259

CVE-2023-37259 affects matrix-react-sdk. The Export Chat feature injects attacker-controlled elements into a generated document without proper escaping, causing stored XSS. The exploit runs from the null origin (document-only context) but can be used to leak message contents; a malicious homeserv...