Arch Linux Security Advisory ASA-202011-4 ========================================= Severity: High Date : 2020-11-03 CVE-ID : CVE-2020-26891 Package : matrix-synapse Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1252 Summary ======= The package matrix-synapse before version 1.21.0-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.21.0-1. # pacman -Syu "matrix-synapse>=1.21.0-1" The problem has been fixed upstream in version 1.21.0. Workaround ========== None. Description =========== A security issue has been found in matrix-synapse before 1.21.0, where HTML pages served via Synapse were vulnerable to cross-site scripting (XSS) attacks. Impact ====== A remote attacker might be able to spoof content and execute code via a cross-site scripting attack. References ========== https://github.com/matrix-org/synapse/releases/tag/v1.21.2 https://github.com/matrix-org/synapse/pull/8444 https://security.archlinux.org/CVE-2020-26891