CVE-2021-22911: Rocket.chat

Critical severity, CVSS 9.8. EPSS: 95.2% chance of exploitation in the next 30 days.

A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.

Affected products

• Rocket.chat Rocket.chat: version 3.11.0 only; version 3.12.0 only; version 3.13.0 only

Published 2021-05-27. Last modified 2026-06-17.