CVE-2026-65644

State: Published
Severity: 7.5 High
Published: Aug 21, 2026
Updated: Aug 27, 2026
Reserved: Jul 22, 2026

Description

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via dangerouslySetInnerHTML in the Omnichannel Queue side panel (InquireSidePanelItem.tsx), injecting a real, clickable HTML link - pointing to any attacker-controlled domain, with arbitrary social-engineering text - into the DOM of any agent viewing the queue.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	CISA-ADP

Weaknesses

CWE-79 Cross-site Scripting (XSS) - DOM

Affected Products

Product	Versions
Rocket.ChatRocket.Chat	before 8.8.0Affected before 8.7.1Affected before 8.6.2Affected before 8.5.3Affected before 8.4.6Affected before 8.3.8Affected before 8.2.8Affected before 8.1.8Affected before 7.10.15Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.