CVE-2026-55850: falha de média gravidade em element-hq element-web
Element Web: A malicious homeserver can inject HTML in Element Web using its homepage
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.5%
Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious homeserver can provide crafted HTML that Element Web renders on the homepage; the content security policy prevents JavaScript but not phishing HTML. This issue is fixed in version 1.12.22.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
element-hq · element-webCVEs relacionadas — element-hq element-web
No mesmo produto, das mais perigosas para as menos.
CVE-2024-51750MEDIUMElement allows a malicious homeserver can modify events leading to unrenderable events or roomsEPSS 0.5%CVE-2024-47779HIGHElement Web vulnerable to potential exposure of access token via authenticated mediaEPSS 0.4%CVE-2025-59161LOWIn Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is leftEPSS 0.4%CVE-2024-51749LOWElement's thumbnails can be abused to misrepresent the content of an attachmentEPSS 0.4%CVE-2025-32026LOWElement Web could load a malicious instance of Element Call leaking media encryption keysEPSS 0.2%CVE-2026-119407HIGHElement Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL ParametersEPSS 0.1%