Is CVE-2026-47733 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47733 being exploited in the wild.

How severe is CVE-2026-47733?

Medium severity, with a CVSS score of 4.4, published 24 June 2026.

Is there a fix for CVE-2026-47733?

A patch was published on 2026-08-05: Fixed in version 8.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47733 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-47733?

Check whether you run Rocket.Chat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47733: Rocket.Chat XSS in ImageElement component via markdown images

CVE-2026-47733 · Severity: medium · CVSS 4.4 · Published 2026-06-24

Rocket.Chat is an open-source communications platform used for team collaboration and messaging. A security flaw in how the platform handles images in messages allows a malicious user to embed hidden scripts within an image link. If a victim using an older web browser clicks on such an image, the script could execute in their session, potentially allowing the attacker to access sensitive information or perform actions on the victim's behalf.

Technologies: Rocket.Chat. Vendors: Rocket.Chat.

Quick answers

Is CVE-2026-47733 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47733 being exploited in the wild.
How severe is CVE-2026-47733?: Medium severity, with a CVSS score of 4.4, published 24 June 2026.
Which products and versions are affected?: Rocket.Chat < 8.5.0.
Is there a fix for CVE-2026-47733?: A patch was published on 2026-08-05: Fixed in version 8.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47733 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47733?: Check whether you run Rocket.Chat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in Rocket.Chat's 'gazzodown' package due to missing protocol sanitization in the ImageElement component. While the analogous LinkSpan component uses a 'sanitizeUrl' function to block dangerous protocols like 'javascript:', 'data:', and 'vbscript:', ImageElement renders user-controlled 'src' values directly into <a> href and <img> src attributes. An authenticated attacker can post a markdown image containing a 'javascript:' URI. While modern browsers typically block JavaScript execution when navigation occurs via target='_blank', users on legacy browsers remain vulnerable to arbitrary script execution in their session context upon clicking the image. This issue is resolved in version 8.5.0 by applying the 'sanitizeUrl' utility to the ImageElement component.

Affected products

RocketChat Rocket.Chat < 8.5.0

Timeline

2026-06-11: advisory: GitHub advisory published by vendor
2026-06-24: disclosed: NVD publication date
2026-08-05: patched: Fixed in version 8.5.0

References

https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-vvrf-fq54-q4pr

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.