CVE-2023-37259

CVE-2023-37259 is a stored Cross-Site Scripting (XSS) vulnerability affecting the matrix-react-sdk, a React-based SDK for integrating Matrix chat/VoIP clients into web pages. Specifically, the "Export Chat" feature inadequately escapes attacker-controlled elements, allowing for code injection. While the XSS runs from a null origin, limiting impact, it could still potentially leak message contents, with malicious homeservers being a possible attacker. The vulnerability has a CVSS score of 5.4 (Medium), indicating a network-based attack with low attack complexity and requiring user interaction, resulting in low confidentiality and integrity impacts. There is no evidence of active exploitation, nor are there any known public exploit codes (Metasploit, Nuclei, ExploitDB). Community discussion and media coverage for this CVE are minimal.