CVE-2023-30609

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client will clear the HTML injection.

• CWE-74

• https://github.com/matrix-org/matrix-react-sdk/commit/bf182bc94556849d7acdfa0e5fdea2aa129ea826Patch
• https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.71.0Release Notes
• https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-xv83-x443-7rmwVendor Advisory
• https://github.com/matrix-org/matrix-react-sdk/commit/bf182bc94556849d7acdfa0e5fdea2aa129ea826Patch
• https://github.com/matrix-org/matrix-react-sdk/releases/tag/v3.71.0Release Notes
• https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-xv83-x443-7rmwVendor Advisory

Published

Apr 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-30603Hitron Technologies CODA-5310 Telnet function with the defau…9.8
• CVE-2023-30604It is identified a vulnerability of insufficient authenticat…9.8
• CVE-2023-30605Archery is an open source SQL audit platform. The Archery pr…6.5
• CVE-2023-30606Discourse is an open source platform for community discussio…4.9
• CVE-2023-30607icingaweb2-module-jira provides integration with Atlassian J…8.8
• CVE-2023-30608sqlparse is a non-validating SQL parser module for Python. I…7.5
• CVE-2023-3061A vulnerability was found in code-projects Agro-School Manag…9.8
• CVE-2023-30610aws-sigv4 is a rust library for low level request signing in…5.5
• CVE-2023-30611Discourse-reactions is a plugin that allows user to add thei…5.3
• CVE-2023-30612Cloud hypervisor is a Virtual Machine Monitor for Cloud work…4.9
• CVE-2023-30613Kiwi TCMS, an open source test management system, allows use…9
• CVE-2023-30614Pay is a payments engine for Ruby on Rails 6.0 and higher. I…6.1