Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST… (CVE-2026-65644)

The vulnerability (CVE-2026-65644) affects multiple Rocket.Chat versions before specified patch versions. The REST API endpoint POST /api/v1/livechat/visitor accepts a 'name' parameter without sanitization or authentication. This raw input is stored and later rendered in the Omnichannel Queue side panel using React's dangerouslySetInnerHTML, leading to injection of attacker-controlled clickable HTML links. This is a stored cross-site scripting (XSS) vulnerability categorized under CWE-79. The CVSS v3.1 score is 7.5 (High), indicating network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact with no integrity or availability impact.

An attacker can inject arbitrary HTML links into the Omnichannel Queue side panel viewed by agents, potentially tricking them into clicking malicious links. This could lead to social engineering attacks but does not directly affect system integrity or availability. Confidentiality is impacted as the injected content could lead to further compromise if agents interact with the malicious links.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is confirmed, restrict access to the Livechat visitor API endpoint or implement input sanitization on the 'name' field to prevent injection of malicious HTML. Avoid rendering untrusted input with dangerouslySetInnerHTML or apply proper escaping. Monitor vendor communications for official patches or updates.