# CVE-2023-30609: Matrix React SDK HTML injection in search results

Source: https://junglewise.ai/threats/cve-2023-30609-matrix-react-sdk-html-injection-in-search-results  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-04-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-30609 · Severity: low · CVSS 3.1 · Published 2023-04-25

Matrix React SDK is a JavaScript library that powers Matrix chat client interfaces. When users search for messages, plaintext messages containing HTML tags are incorrectly rendered as active HTML in the search results, allowing attackers to inject malicious scripts. An attacker can trick a user into searching for a specially crafted message to execute cross-site scripting (XSS) attacks and steal data or compromise the user's account.

Technologies: [Matrix.org React SDK](https://junglewise.ai/threats/technologies/react-sdk), [matrix-react-sdk (npm)](https://junglewise.ai/threats/technologies/matrix-react-sdk). Vendors: [Matrix.org](https://junglewise.ai/threats/vendors/matrix-org), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-30609 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-30609 being exploited in the wild.

**How severe is CVE-2023-30609?** Low severity, with a CVSS score of 3.1, published 25 April 2023.

**Which products and versions are affected?** Matrix.org React SDK <= 3.70.0; matrix-react-sdk (npm) SEMVER:introduced=0,fixed=3.71.0.

**Is there a fix for CVE-2023-30609?** Yes. matrix-react-sdk (npm): upgrade to 3.71.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-30609 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-30609?** Check whether you run Matrix.org React SDK or matrix-react-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- matrix-react-sdk (npm): upgrade to 3.71.0 or later

  ```sh
  npm install matrix-react-sdk@3.71.0
  ```


## Technical details

The vulnerability is an HTML injection / cross-site scripting (CWE-74, CWE-79) in the search results display logic. When rendering search results, the SDK fails to properly sanitize or escape HTML entities in plaintext messages, causing HTML tags to be interpreted as markup rather than literal text. The attack requires authentication (PR:L) and user interaction (UI:R) to lure a victim into searching for the payload. However, the scope changes (S:C), affecting resources outside the search component. An attacker can inject resources from recaptcha.net and gstatic.com (domains whitelisted in the default CSP) to perform stored XSS. The issue is fixed in version 3.71.0; users can temporarily work around it by restarting the client.

## Affected products

- Matrix.org React SDK <= 3.70.0

## Identifiers

- CVE-2023-30609
- GHSA-xv83-x443-7rmw

## Timeline

- 2023-04-25: disclosed
- 2023-04-25: patched: Version 3.71.0 released

## References

- [https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-xv83-x443-7rmw](https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-xv83-x443-7rmw)

## Related threats

- [Matrix React SDK information disclosure on room invitation](https://junglewise.ai/threats/cve-2024-47824-matrix-react-sdk-information-disclosure-on-room-invitation)
- [Matrix SDK for React URL preview bypass in encrypted rooms](https://junglewise.ai/threats/cve-2024-42347-matrix-sdk-for-react-url-preview-bypass-in-encrypted-rooms)
- [matrix-react-sdk XSS in Export Chat feature](https://junglewise.ai/threats/cve-2023-37259-matrix-react-sdk-xss-in-export-chat-feature)
- [Matrix matrix-react-sdk prototype pollution](https://junglewise.ai/threats/cve-2023-28103-matrix-matrix-react-sdk-prototype-pollution)
- [Matrix.org matrix-react-sdk prototype pollution in event processing](https://junglewise.ai/threats/cve-2022-36060-matrix-org-matrix-react-sdk-prototype-pollution-in-event)