CVE-2026-47733

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 8.5.0

Description The ImageElement component in packages/gazzodown renders user-controlled src values directly into <a href> and <img src> attributes without protocol sanitization. While the LinkSpan component utilizes sanitizeUrl to block javascript:, data:, and vbscript: protocols, ImageElement allows raw URLs to pass through unchanged. An authenticated user can post a markdown image containing a javascript: URL, which may execute arbitrary JavaScript in the viewer's session when clicked on older browsers.

Recommendations Update to version 8.5.0.