CVE-2024-51750

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

Element is a Matrix web client built using the Matrix React SDK. A malicious homeserver can send invalid messages over federation which can prevent Element Web and Desktop from rendering single messages or the entire room containing them. This was patched in Element Web and Desktop 1.11.85.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Weakness enumeration

CWE-248

Affected software

No affected versions have been published.

Timeline

Published: Nov 12, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-517516.5Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are CVE-2024-517525.5The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. I CVE-2024-517532.1The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In af CVE-2024-517542.2Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not CVE-2024-517552.2Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the s CVE-2024-517562.3The cap-std project is organized around the eponymous `cap-std` crate, and develops libraries to make it easy to write capability-based code CVE-2024-517579.3happy-dom is a JavaScript implementation of a web browser without its graphical user interface. Versions of happy-dom prior to 15.10.2 may e CVE-2024-517582.3Filament is a collection of full-stack components for accelerated Laravel development. All Filament features that interact with storage use CVE-2024-517597.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Detlef Beyer SVT Simple svt-simple all CVE-2024-51769.4Insufficiently Protected Credentials vulnerability in Baxter Welch Allyn Configuration Tool may allow Remote Services with Stolen Credential CVE-2024-517607.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ristretto Apps Dashing Memberships das CVE-2024-517617.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zackgilbert WPHelpful wphelpful allows