Psych0Tr1A

The issue allows a remote attacker to inject arbitrary JavaScript in a message using nested markdown tags, leading to persistent cross-site scripting (XSS). This flaw can result in arbitrary file read and remote code execution (RCE) on the Rocket.Chat desktop app.

The issue is related to Stored XSS, which can lead to Remote Code Execution.

The issue allows remote attackers to inject arbitrary JavaScript code into any message on the forum via multiple stored XSS.