Unsanitized HTML Injection via the Homeserver-Controlled Home Page URL

Description

// Replace '," and HTML encoded variants
let body = (await res.text()).replace(
    /_t\((?:['"]|(?:&#(?:34|27);))([\s\S]*?)(?:['"]|(?:&#(?:34|27);))\)/gm,
    (match, g1) => this.translate(g1),
);

if (this.props.replaceMap) {
    Object.keys(this.props.replaceMap).forEach((key) => {
        body = body.split(key).join(this.props.replaceMap![key]);
    });
}

this.setState({ page: body });

const content = <div className={`${className}_body`} dangerouslySetInnerHTML={{ __html: this.state.page }} />;

export function getHomePageUrl(appConfig: IConfigOptions, matrixClient: MatrixClient): string | undefined {
    const config = new SnakedObject(appConfig);

    const pagesConfig = config.get("embedded_pages");
    let pageUrl = pagesConfig ? new SnakedObject(pagesConfig).get("home_url") : null;

    if (!pageUrl) {
        pageUrl = getEmbeddedPagesWellKnown(matrixClient)?.home_url;
    }

    return pageUrl;
}

const EMBEDDED_PAGES_WK_PROPERTY = "io.element.embedded_pages";

export function getEmbeddedPagesWellKnown(matrixClient: MatrixClient | undefined): IEmbeddedPagesWellKnown | undefined {
    return embeddedPagesFromWellKnown(matrixClient?.getClientWellKnown());
}

export function embeddedPagesFromWellKnown(clientWellKnown?: IClientWellKnown): IEmbeddedPagesWellKnown {
    return clientWellKnown?.[EMBEDDED_PAGES_WK_PROPERTY];
}

Impact

• A hostile homeserver operator, or anyone who has taken one over, can put attacker-controlled markup on the home page of every Element Web client that authenticates against that server. The home page is the default view after login and after registration and stays reachable from the Home button, so the injected content is persistent rather than a single shot.
• Script execution is blocked, so messages, access tokens, and key material stay out of reach. What remains is credential phishing. frame-src * admits a full-viewport iframe from any origin, and a form inside that iframe has its own browsing context, so the parent's form-action 'self' does not constrain where it submits. A session-expired dialog styled like the surrounding client collects the user's password and sends it to the attacker, inside an application the user has already decided to trust. We confirmed this end to end against Element Web v1.11.96.
• img-src * additionally allows tracking pixels that report when and how often a given user opens the client, and style-src 'unsafe-inline' lets the injected markup restyle the interface around it.

Mitigation

Update Element Web or Element Desktop to 1.12.22 or later. The fix renders the embedded page through the shared sanitizedHtmlNode helper, which strips the tags the injection depends on. Deployments that cannot update immediately should set embedded_pages.home_url explicitly in config.json, which stops the resolver from consulting the homeserver-controlled well-known key at all. Independently of the version, narrowing frame-src to 'self' plus the widget and call origins actually in use removes the phishing primitive, and adding base-uri 'none' closes a defense-in-depth gap, since base-uri does not fall back to default-src. For people using a client they do not administer: the home page has no legitimate reason to ask for a password, so treat any login prompt that appears there as suspicious until the client is updated.

Defender's Checklist

• Update to Element Web or Element Desktop 1.12.22 or later.

  Every earlier release renders the embedded home page unsanitized. The fix is pull request #33842.

• Pin embedded_pages.home_url in your own config.

  getHomePageUrl() only consults the homeserver's well-known when the deployment config leaves the key unset. Setting it in config.json takes the homeserver out of the trust path for the home page, in any version. Check the config.json you actually deploy, not the sample.

• Tighten the deployment CSP.

  frame-src * is what turns markup injection into a phishing surface, because a form inside a third-party iframe is not bound by the parent's form-action 'self'. Narrow it to 'self' plus the widget and call origins you actually use, and add base-uri 'none', which does not fall back to default-src.

• Check forks and custom home pages.

  Products built on the Element Web codebase inherit both the unsanitized render and the well-known fallback. If you maintain a fork, or ship your own home page, confirm the fix is merged and that your deployment pins home_url.

Severity Reasoning

References

• GHSA-wrcp-5v3v-3j6v (Element)
• CVE-2026-55850 (NVD)
• Element Web v1.12.22 Release
• Element Web pull request #33842 (fix)
• matrix-react-sdk pull request #7790 (origin of the well-known fallback)
• Element Web Repository
• CVE-2024-42347 (NVD, S:C scoring precedent)
• CVE-2023-30609 (NVD, S:C scoring precedent)
• Related: Element X Android crash via a malformed OIDC redirect intent

How We Can Help

• Security Architecture Review
• MDR Penetration Testing