CVE-2021-22886

Published: Mar 26, 2021Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.

Affected (11)

Products: Rocket.chat: Rocket.chat

Rocket.chat

1 product

Rocket.chat

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Rocket.chat Rocket.chat	version < 3.8.8
Rocket.chat Rocket.chat	3.10.0 ≤ version < 3.10.5
Rocket.chat Rocket.chat	3.9.0 ≤ version < 3.9.7
Rocket.chat Rocket.chat	Version 3.11.0 rc0
Rocket.chat Rocket.chat	Version 3.11.0 rc1
Rocket.chat Rocket.chat	Version 3.11.0 rc2
Rocket.chat Rocket.chat	Version 3.11.0 rc3
Rocket.chat Rocket.chat	Version 3.11.0 rc4
Rocket.chat Rocket.chat	Version 3.11.0 rc5
Rocket.chat Rocket.chat	Version 3.11.0 rc6
Rocket.chat Rocket.chat	Version 3.11.0 rc7