Element Web renders content supplied by a homeserver’s homepage through the EmbeddedPage component using dangerouslySetInnerHTML. Because this content is not passed through a sanitization routine, an attacker who controls a Matrix homeserver can supply crafted HTML that Element Web will display unmodified. The browser’s content‑security policy prevents JavaScript execution, but the injected markup can still be used for phishing or other client‑side attacks, constituting a client‑side cross‑site scripting vulnerability that can lead to credential theft or social‑engineering exploitation.

Element Web from Element HQ, versions prior to 1.12.22. Version 1.12.22 and later include the security fix.

The CVSS score is 5.3, giving the vulnerability a medium severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must control a homeserver that a customer uses; once the client loads that server’s homepage, the unsanitized HTML is rendered, allowing the attacker to present phishing pages or other malicious content. This makes the attack vector local to the homeserver but potentially impacting any user who accesses the compromised server via Element Web.