CVE-2026-65644

Katalog CVE

CVSS 7.5 · High EPSS 0,48%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada rocket.chat. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via dangerouslySetInnerHTML in the Omnichannel Queue side panel (InquireSidePanelItem.tsx), injecting a real, clickable HTML link - pointing to any attacker-controlled domain, with arbitrary social-engineering text - into the DOM of any agent viewing the queue.

Rincian

Terbit di NVD

21 Agustus 2026

Terakhir diubah

4 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/RocketChat/Rocket.Chat/pull/41595 patch · advisory vendor
• https://hackerone.com/reports/3872858 advisory pihak ketiga · issue tracking