CVE-2021-22886

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 3.11 Rocket.Chat version 3.10.5 Rocket.Chat version 3.9.7 Rocket.Chat version 3.8.8

Description The issue allows a remote attacker to inject arbitrary JavaScript in a message using nested markdown tags, leading to persistent cross-site scripting (XSS). This flaw can result in arbitrary file read and remote code execution (RCE) on the Rocket.Chat desktop app.

Recommendations For Rocket.Chat version 3.8.8, update to a version later than 3.8.8 to resolve the issue. For Rocket.Chat version 3.9.7, update to a version later than 3.9.7 to resolve the issue. For Rocket.Chat version 3.10.5, update to a version later than 3.10.5 to resolve the issue. For Rocket.Chat versions prior to 3.11, update to version 3.11 or later to resolve the issue.