Impact
In Element Web and Element Desktop 1.12.27 and earlier, the HTML chat export is vulnerable to XSS via two attack vectors, caused by unsanitised attachment filenames and user avatar MXIDs.
Since the Export Chat feature generates a separate document, an attacker can only inject code run from the null origin, restricting the impact. However, the attacker can still potentially use the XSS to leak message contents.
Patches
Patched in Element Web 1.12.28 and Element Desktop 1.12.28.
Workarounds
Do not export chats as HTML in rooms with untrusted members.
kah-ja Reporter
Impact
In Element Web and Element Desktop 1.12.27 and earlier, the HTML chat export is vulnerable to XSS via two attack vectors, caused by unsanitised attachment filenames and user avatar MXIDs.
Since the Export Chat feature generates a separate document, an attacker can only inject code run from the null origin, restricting the impact. However, the attacker can still potentially use the XSS to leak message contents.
Patches
Patched in Element Web 1.12.28 and Element Desktop 1.12.28.
Workarounds
Do not export chats as HTML in rooms with untrusted members.