CVE-2026-65644
Received Received - Intake

Cross-Site Scripting in Rocket.Chat Livechat Visitor Name

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: HackerOne

Description
Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via dangerouslySetInnerHTML in the Omnichannel Queue side panel (InquireSidePanelItem.tsx), injecting a real, clickable HTML link - pointing to any attacker-controlled domain, with arbitrary social-engineering text - into the DOM of any agent viewing the queue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-65644
EUVD
EUVD-2026-63806

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rocket_chat rocket_chat to 8.8.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Rocket.Chat versions before 8.8.0 allows an attacker to inject malicious HTML or JavaScript code through the visitor name field in the Livechat REST API endpoint. The injected code is stored and later rendered unsafely in the Omnichannel Queue side panel, creating a clickable link that could execute arbitrary actions when viewed by an agent.

Detection Guidance

Check Rocket.Chat server logs for suspicious visitor name entries containing HTML or JavaScript code. Inspect the Omnichannel Queue side panel for rendered links pointing to unexpected domains. Use browser developer tools to examine DOM elements for injected scripts or links in visitor name fields.

Impact Analysis

An attacker could trick agents into clicking malicious links, leading to potential account compromise, data theft, or further exploitation of the agent's browser. This could expose sensitive customer conversations, personal data, or internal system access depending on the agent's permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using vulnerable versions may face compliance breaches if customer or patient data is exposed through such attacks.

Mitigation Strategies

Upgrade Rocket.Chat to a patched version (8.8.0 or later, or specific 8.x versions as listed). If immediate upgrade is not possible, restrict access to the /api/v1/livechat/visitor endpoint via network controls. Monitor the Omnichannel Queue for unusual visitor names or links.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65644. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart