{"id":"CVE-2023-37259","aliases":["GHSA-c9vx-2g7w-rp65"],"url":"https://o3.security/vulnerability/CVE-2023-37259","summary":"Cross site scripting in Export Chat feature","details":"matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting (XSS). Since the Export Chat feature generates a separate document, an attacker can only inject code run from the `null` origin, restricting the impact. However, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side. This issue has been addressed in commit `22fcd34c60` which is included in release version 3.76.0. Users are advised to upgrade. The only known workaround for this issue is to disable or to not use the Export Chat feature.","published":"2023-07-18T16:59:21.659Z","modified":"2026-08-12T03:51:28.045150766Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"matrix-react-sdk","fixedVersion":"3.76.0"}],"fix":{"url":"https://github.com/matrix-org/matrix-react-sdk/commit/22fcd34c606f32129ebc967fc21f24fb708a98b8","label":"matrix-org/matrix-react-sdk@22fcd34"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37259.json"},{"type":"ADVISORY","url":"https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-c9vx-2g7w-rp65"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37259"},{"type":"FIX","url":"https://github.com/matrix-org/matrix-react-sdk/commit/22fcd34c606f32129ebc967fc21f24fb708a98b8"},{"type":"PACKAGE","url":"https://github.com/matrix-org/matrix-react-sdk"},{"type":"WEB","url":"https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.76.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:28.045150766Z"}}