← Back

CVE-2021-22886

nvd nist
Published: Mar 26, 2021Modified: Jun 17, 2026

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.7
Source: NVD

Description

Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.

Affected (11)

Rocket.chat
1 product
Rocket.chat
Configuration A
11 vulnerable
Vulnerable SoftwareAffected Versions
Rocket.chat
Rocket.chat
Before 3.8.8
Rocket.chat
From 3.10.0 to 3.10.5
Rocket.chat
From 3.9.0 to 3.9.7
Rocket.chat
Version 3.11.0 rc0
Rocket.chat
Version 3.11.0 rc1
Rocket.chat
Version 3.11.0 rc2
Rocket.chat
Version 3.11.0 rc3
Rocket.chat
Version 3.11.0 rc4
Rocket.chat
Version 3.11.0 rc5
Rocket.chat
Version 3.11.0 rc6
Rocket.chat
Version 3.11.0 rc7

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (6)

Source: support@hackerone.com
Vendor Advisory
Source: support@hackerone.com
PatchThird Party Advisory
Source: support@hackerone.com
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.