CVE-2021-21333

Synapse is a Matrix reference homeserver written in python (pypi package
matrix-synapse). Matrix is an ecosystem for open federated Instant
Messaging and VoIP. In Synapse before version 1.27.0, the notification
emails sent for notifications for missed messages or for an expiring
account are subject to HTML injection. In the case of the notification for
missed messages, this could allow an attacker to insert forged content into
the email. The account expiry feature is not enabled by default and the
HTML injection is not controllable by an attacker. This is fixed in version
1.27.0.

Bugs

• <https://github.com/matrix-org/synapse/pull/9200&gt;