CVE-2026-65644

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 8.8.0 Rocket.Chat versions prior to 8.7.1 Rocket.Chat versions prior to 8.6.2 Rocket.Chat versions prior to 8.5.3 Rocket.Chat versions prior to 8.4.6 Rocket.Chat versions prior to 8.3.8 Rocket.Chat versions prior to 8.2.8 Rocket.Chat versions prior to 8.1.8 Rocket.Chat versions prior to 7.10.15

Description A REST API endpoint 'POST /api/v1/livechat/visitor' accepts an unauthenticated and unsanitized name field for Livechat visitors. This data is stored without validation and subsequently rendered using the dangerouslySetInnerHTML function in the Omnichannel Queue side panel (InquireSidePanelItem.tsx). This allows an attacker to inject a clickable HTML link with arbitrary social-engineering text pointing to a malicious domain into the DOM of any agent viewing the queue.

Recommendations Update to version 8.8.0 or later. Update to version 8.7.1 or later. Update to version 8.6.2 or later. Update to version 8.5.3 or later. Update to version 8.4.6 or later. Update to version 8.3.8 or later. Update to version 8.2.8 or later. Update to version 8.1.8 or later. Update to version 7.10.15 or later. As a temporary mitigation, restrict access to the 'POST /api/v1/livechat/visitor' endpoint.