CVE-2026-55850
Received Received - Intake

Cross-Site Scripting in Element Web via Unsanitized Homepage Content

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious homeserver can provide crafted HTML that Element Web renders on the homepage; the content security policy prevents JavaScript but not phishing HTML. This issue is fixed in version 1.12.22.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-55850
EUVD
EUVD-2026-64046

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
element element_desktop 1.12.22
element element_web 1.12.22

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Element Web (before version 1.12.22) allows a malicious homeserver to inject crafted HTML into the application's homepage. The EmbeddedPage component renders this content without proper sanitization, using dangerouslySetInnerHTML. While JavaScript execution is blocked by the Content Security Policy (CSP), the injected HTML can still be used for phishing attacks, such as embedding fake login prompts in iframes.

Detection Guidance

Check Element Web version with: element-web --version. If version is below 1.12.22, the system is vulnerable. Inspect network traffic for unexpected homepage content or iframe injections from homeserver responses.

Impact Analysis

The vulnerability enables phishing attacks where attackers can trick users into entering credentials or sensitive information via fake login prompts. The attack is persistent, remaining visible after login, and can track users through injected tracking pixels. It requires the attacker to control the homeserver.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling phishing attacks that steal user credentials or sensitive data. A malicious homeserver could inject HTML into the homepage, creating fake login prompts or tracking pixels. This risks unauthorized access to personal data, violating GDPR principles of data protection and HIPAA requirements for safeguarding protected health information.

Mitigation Strategies

Upgrade Element Web to version 1.12.22 or later. Set embedded_pages.home_url in config.json to a trusted URL to prevent fallback to homeserver-controlled content. Tighten CSP by restricting frame-src and adding base-uri 'none'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55850. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart