Unknown · Rocket.Chat · CVE-2026-65644
**Name of the Vulnerable Software and Affected Versions**
Rocket.Chat versions prior to 8.8.0
Rocket.Chat versions prior to 8.7.1
Rocket.Chat versions prior to 8.6.2
Rocket.Chat versions prior to 8.5.3
Rocket.Chat versions prior to 8.4.6
Rocket.Chat versions prior to 8.3.8
Rocket.Chat versions prior to 8.2.8
Rocket.Chat versions prior to 8.1.8
Rocket.Chat versions prior to 7.10.15
**Description**
A REST API endpoint 'POST /api/v1/livechat/visitor' accepts an unauthenticated and unsanitized `name` field for Livechat visitors. This data is stored without validation and subsequently rendered using the `dangerouslySetInnerHTML` function in the Omnichannel Queue side panel (InquireSidePanelItem.tsx). This allows an attacker to inject a clickable HTML link with arbitrary social-engineering text pointing to a malicious domain into the DOM of any agent viewing the queue.
**Recommendations**
Update to version 8.8.0 or later.
Update to version 8.7.1 or later.
Update to version 8.6.2 or later.
Update to version 8.5.3 or later.
Update to version 8.4.6 or later.
Update to version 8.3.8 or later.
Update to version 8.2.8 or later.
Update to version 8.1.8 or later.
Update to version 7.10.15 or later.
As a temporary mitigation, restrict access to the 'POST /api/v1/livechat/visitor' endpoint.