Element Web HTML Injection via Uncleaned Home Page URL (CVE-2026-55859)

HTML Injection in Element Web via Home Page URL Not Being Sanitized Vulnerability Overview The component in Element Web retrieves the home page from a configurable URL and renders the response using without sanitization. When a deployment does not pin to its own configuration, the URL is read from the homeserver's document. Consequently, a malicious homeserver operator can inject arbitrary markup into every user's client when logging into that server. While the Content Security Policy (CSP) prevents script execution, the directive leaves a risk of credential phishing through injected iframes. Scope Affected Versions: All versions prior to 1.12.22 (Element Web and Element Desktop) CVSS 3.1 Vector: AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation) Fixed Version: 1.12.22 CVE: CVE-2026-55859 GHSA: GHSA-wrcp-5v3v-3j6v Remediation Update Element Web or Element Desktop to 1.12.22 or later: The renderer now uses the shared helper to render embedded pages instead of . Pin in your configuration: only consults the homeserver's if the configuration key is not set in the deployment configuration; otherwise, it falls back to the homeserver. Setting this value in removes the homeserver from the trust path. Tighten Deployment CSP: The directive is the cause of the phishing surface for injected markup, as forms inside iframes are not constrained by the parent's . Narrow this down to plus any actual widgets and calling origins used, and add , which does not fall back to . Check Forks and Custom Home Pages: Products based on the Element Web codebase inherit the un-sanitized renderer and the known fallback. If you maintain a fork or ship your own home page, ensure the fix has been merged into your deployment and that is pinned. Code Snippets References GHSA-wrcp-5v3v-3j6v (Element) CVE-2026-55859 (NVD) Element Web v1.12.22 Release Element Web pull request #33842 (fix) matrix-react-sdk pull request #7790 (origin of the well-known fallback) Element Web Repository CVE-2024-42347 (NVD, S:C scoring precedent) CVE-2023-30609 (NVD, S:C scoring precedent) Related: Element X Android crash via a malformed OIDC redirect intent

Goal Reached Thanks to every supporter — we hit 100%!

Element Web HTML Injection via Uncleaned Home Page URL (CVE-2026-55859)