CVE-2021-22886: Rocket.chat

Medium severity, CVSS 6.1. EPSS: 1.7% chance of exploitation in the next 30 days.

Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.

Affected products

• Rocket.chat Rocket.chat: before 3.8.8 (fixed in 3.8.8); from 3.9.0, before 3.9.7 (fixed in 3.9.7); from 3.10.0, before 3.10.5 (fixed in 3.10.5); version 3.11.0 only

Published 2021-03-26. Last modified 2026-06-17.