CVE-2024-46934: Rocket.chat

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to DOM-based Cross-site Scripting (XSS). Attackers may be able to abuse the UpdateOTRAck method to forge a message that contains an XSS payload.

Affected products

• Rocket.chat Rocket.chat: before 6.7.9 (fixed in 6.7.9); from 6.8.0, before 6.8.7 (fixed in 6.8.7); from 6.9.0, before 6.9.7 (fixed in 6.9.7); from 6.10.0, before 6.10.6 (fixed in 6.10.6); from 6.11.0, before 6.11.3 (fixed in 6.11.3); version 6.12.0 only

Published 2024-09-25. Last modified 2026-06-17.