CVE-2026-55850

MediumCVSS 5.3

Published: 21/08/2026(UTC)Updated: 14/10/2026(UTC)Translated: 22/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.55%

45th percentile - higher than 45% of all known CVEs

Summary

In Element Web before 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious homeserver can provide crafted HTML that Element Web renders on the homepage; the content security policy prevents JavaScript but not phishing HTML.

Risk Assessment

Users may be exposed to phishing attacks because a malicious homeserver can display fake content on the homepage.

Recommendation

It is recommended to upgrade Element Web to version 1.12.22 or later, which includes a fix.

Other vulnerabilities in Element Web

CVE-2025-59161Low
Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated attacker-supplied room. While the effect is temporary, it may confuse users into acting on incorrect assumptions. The issue has been patched and users should upgrade to 1.11.112.

Original NVD description (English source)

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious homeserver can provide crafted HTML that Element Web renders on the homepage; the content security policy prevents JavaScript but not phishing HTML. This issue is fixed in version 1.12.22.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS