CVE-2026-65644

Analyzed Analyzed - Analysis Complete

Cross-Site Scripting in Rocket.Chat Livechat Visitor Name

Publication date: 2026-08-21

Last updated on: 2026-09-04

Assigner: HackerOne

Description

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via dangerouslySetInnerHTML in the Omnichannel Queue side panel (InquireSidePanelItem.tsx), injecting a real, clickable HTML link - pointing to any attacker-controlled domain, with arbitrary social-engineering text - into the DOM of any agent viewing the queue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-09-04

Generated

2026-09-10

AI Q&A

2026-08-21

EPSS Evaluated

2026-09-09

NVD

CVE-2026-65644

EUVD

EUVD-2026-63806

Affected Vendors & Products

Vendor	Product	Version / Range
rocket.chat	rocket.chat	to 7.10.15 (exc)
rocket.chat	rocket.chat	From 8.2.0 (inc) to 8.2.8 (exc)
rocket.chat	rocket.chat	From 8.3.0 (inc) to 8.3.8 (exc)
rocket.chat	rocket.chat	From 8.4.0 (inc) to 8.4.6 (exc)
rocket.chat	rocket.chat	From 8.5.0 (inc) to 8.5.3 (exc)
rocket.chat	rocket.chat	From 8.6.0 (inc) to 8.6.2 (exc)
rocket.chat	rocket.chat	From 8.1.0 (inc) to 8.1.8 (exc)
rocket.chat	rocket.chat	8.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability in Rocket.Chat versions before 8.8.0 allows an attacker to inject malicious HTML or JavaScript code through the visitor name field in the Livechat REST API endpoint. The injected code is stored and later rendered unsafely in the Omnichannel Queue side panel, creating a clickable link that could execute arbitrary actions when viewed by an agent.

Detection Guidance

Check Rocket.Chat server logs for suspicious visitor name entries containing HTML or JavaScript code. Inspect the Omnichannel Queue side panel for rendered links pointing to unexpected domains. Use browser developer tools to examine DOM elements for injected scripts or links in visitor name fields.

Impact Analysis

An attacker could trick agents into clicking malicious links, leading to potential account compromise, data theft, or further exploitation of the agent's browser. This could expose sensitive customer conversations, personal data, or internal system access depending on the agent's permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using vulnerable versions may face compliance breaches if customer or patient data is exposed through such attacks.

Mitigation Strategies

Upgrade Rocket.Chat to a patched version (8.8.0 or later, or specific 8.x versions as listed). If immediate upgrade is not possible, restrict access to the /api/v1/livechat/visitor endpoint via network controls. Monitor the Omnichannel Queue for unusual visitor names or links.

Hi! I’m here to help you understand CVE-2026-65644. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70