{"id":"CVE-2023-37259","summary":"Cross site scripting in Export Chat feature","details":"matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting (XSS). Since the Export Chat feature generates a separate document, an attacker can only inject code run from the `null` origin, restricting the impact. However, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side. This issue has been addressed in commit `22fcd34c60` which is included in release version 3.76.0. Users are advised to upgrade. The only known workaround for this issue is to disable or to not use the Export Chat feature.","aliases":["GHSA-c9vx-2g7w-rp65"],"modified":"2026-08-12T03:51:28.045150766Z","published":"2023-07-18T16:59:21.659Z","related":["openSUSE-SU-2024:13054-1","openSUSE-SU-2024:13055-1"],"database_specific":{"cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37259.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37259.json"},{"type":"ADVISORY","url":"https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-c9vx-2g7w-rp65"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37259"},{"type":"FIX","url":"https://github.com/matrix-org/matrix-react-sdk/commit/22fcd34c606f32129ebc967fc21f24fb708a98b8"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/matrix-org/matrix-react-sdk","events":[{"introduced":"4ceb2a74cf44daf21322e25adcdf5ad6a72b5f8f"},{"fixed":"35c7df19aff56befd8d06980dfe79a699710a14e"},{"fixed":"22fcd34c606f32129ebc967fc21f24fb708a98b8"}],"database_specific":{"cpe":"cpe:2.3:a:matrix-react-sdk_project:matrix-react-sdk:*:*:*:*:*:node.js:*:*","extracted_events":[{"introduced":"3.32.0"},{"fixed":"3.76.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-37259.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N"}]}