Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@element-hq/element-call-embedded

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.6npmAmendedPublished

    Element Call reports full URLs of visited pages to analytics server

    CVE-2026-48007 · GHSA-6vhh-4xw6-h2h2

    Affected
    • npm @element-hq/element-call-embedded >= 0.5.17, <= 0.19.3
    Fixed in
    0.19.4· Vendor fix available
    Issue
    Impact Element Call versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by a posthog key in config.json or by the posthogApiHost and posthogApiKey URL parameters. Several fields of this data ($initialpersoninfo, $sessionentryurl, and $currenturl) were found to contain the full URL of the user's visited page, including the fragment. Users of a standalone Element Call ‘SPA’ instance such as https://call.element.io may therefore have reported the full URLs of certain calls, including encryption passwords, to the configured PostHog server, potentially compromising the confidentiality of the calls to actors who could access both the PostHog analytics data and the encrypted media streams. The same issue is present in Element Call's embedded package, but in practice it does not impact applications using this package (including Element Web, Element Desktop, Element X iOS, and Element X Android) because they distribute encryption keys over Matrix…

    Recommended action: Upgrade to 0.19.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →