CVE-2026-55850: Element Web: A malicious homeserver can inject HTML in Element Web using its homepage
Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious homeserver can provide crafted HTML that Element Web renders on the homepage; the content security policy prevents JavaScript but not phishing HTML. This issue is fixed in version 1.12.22.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Element Webto a version that resolves this vulnerability.Fixed in 1.12.22
Event History
Frequently Asked Questions
Who is exposed to this issue?
Element Web users who connect to a malicious homeserver are exposed if they use a version earlier than 1.12.22. The homeserver can supply crafted homepage HTML that Element Web renders.
What does an attacker need to exploit it?
An attacker needs control of a homeserver that provides the homepage content. They can use crafted HTML for phishing; the content security policy prevents JavaScript execution.
Are users protected by default browser controls?
The described content security policy blocks JavaScript, but it does not prevent phishing HTML from being rendered. Users can therefore still be presented with deceptive homeserver-supplied content.
How can I remediate the issue?
Upgrade Element Web to version 1.12.22, which fixes the unsafe rendering path by sanitizing the homeserver-supplied homepage content.