CVE-2021-22910: Rocket.chat

Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days.

A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an endpoint which could result in a NoSQL injection, potentially leading to RCE.

Affected products

• Rocket.chat Rocket.chat: before 3.11.4 (fixed in 3.11.4); from 3.12.0, before 3.12.4 (fixed in 3.12.4); from 3.13.0, before 3.13.2 (fixed in 3.13.2)

Published 2021-08-09. Last modified 2026-06-17.