The vulnerability in Rocket.Chat involves the REST API endpoint POST /api/v1/livechat/visitor which accepts an unauthenticated and unsanitized 'name' field for Livechat visitors. This input is stored raw and later rendered in the Omnichannel Queue side panel (InquireSidePanelItem.tsx) using dangerouslySetInnerHTML, enabling injection of arbitrary HTML links. These links can point to attacker-controlled domains and contain arbitrary social-engineering text, potentially deceiving agents who view the queue. This is classified as a Cross-Site Scripting (XSS) vulnerability (CWE-79).

An attacker can inject malicious clickable links into the Omnichannel Queue interface seen by agents, potentially leading to social engineering attacks. This could result in agents being tricked into visiting malicious sites or performing unintended actions. The vulnerability affects the integrity of the user interface and could facilitate targeted phishing or other social engineering exploits against support agents.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Livechat API endpoint to trusted users or networks if possible. Avoid exposing the vulnerable Rocket.Chat versions in untrusted environments. Monitor official Rocket.Chat channels for updates and apply patches as soon as they are released.