Read the docs
TI-2021-05747 Aliases CVE-2021-22886GHSA-pvw2-rgm6-7685

Cross-site scripting in Rocket.Chat

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.

Why it matters now

EPSS 0.01885 79th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Rocket.ChatFixed in 3.11, 3.10.5, 3.9.7, 3.8.8—No fix listedCNA
  • Rocket.Chat Vendor— Affected Fixed in 3.11, 3.10.5, 3.9.7, 3.8.8 Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*before 3.8.8; 3.9.0 to before 3.9.7; 3.10.0 to before 3.10.5VulnerableRocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc0:*:*:*:*:*:*3.11.0 rc0VulnerableRocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc1:*:*:*:*:*:*3.11.0 rc1VulnerableRocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc2:*:*:*:*:*:*3.11.0 rc2VulnerableRocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc3:*:*:*:*:*:*3.11.0 rc3VulnerableRocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc4:*:*:*:*:*:*3.11.0 rc4VulnerableRocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc5:*:*:*:*:*:*3.11.0 rc5VulnerableRocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc6:*:*:*:*:*:*3.11.0 rc6VulnerableRocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc7:*:*:*:*:*:*3.11.0 rc7VulnerableRocket.Chat
  • cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:* Versions before 3.8.8; 3.9.0 to before 3.9.7; 3.10.0 to before 3.10.5 Vulnerable ·Rocket.Chat
  • cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc0:*:*:*:*:*:* Versions 3.11.0 rc0 Vulnerable ·Rocket.Chat
  • cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc1:*:*:*:*:*:* Versions 3.11.0 rc1 Vulnerable ·Rocket.Chat
  • cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc2:*:*:*:*:*:* Versions 3.11.0 rc2 Vulnerable ·Rocket.Chat
  • cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc3:*:*:*:*:*:* Versions 3.11.0 rc3 Vulnerable ·Rocket.Chat
  • cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc4:*:*:*:*:*:* Versions 3.11.0 rc4 Vulnerable ·Rocket.Chat
  • cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc5:*:*:*:*:*:* Versions 3.11.0 rc5 Vulnerable ·Rocket.Chat
  • cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc6:*:*:*:*:*:* Versions 3.11.0 rc6 Vulnerable ·Rocket.Chat
  • cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc7:*:*:*:*:*:* Versions 3.11.0 rc7 Vulnerable ·Rocket.Chat

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-22886
  2. 2026-10-03 Alias added: GHSA-pvw2-rgm6-7685

References

Patch 1

Advisory 2

  • TI-2021-05772 A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 &… CVSS 3.1CRITICAL 9.8
  • TI-2022-13921 SQL injection in Rocket.Chat CVSS 3.1HIGH 8.8
  • TI-2026-18910 Rocket.Chat Unauthorized Access to OAuth App Details CVSS 3.1HIGH 7.7
  • TI-2022-12398 Improper authentication in Rocket.Chat Mobile app CVSS 3.1MEDIUM 6.8
  • TI-2022-13929 Information disclosure in Rocket.Chat CVSS 3.1MEDIUM 6.5
  • TI-2022-15931 Cross-site scripting in Rocket.chat CVSS 3.1MEDIUM 5.4
See all 61 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences