Executive brief
Rocket.Chat's Omnichannel feature allows unauthenticated users to create livechat visitor accounts with arbitrary names that are never sanitized. These names are later displayed in the agent's queue panel using unsafe HTML rendering, enabling an attacker to inject malicious links or content that appears to support staff. When an agent views the queue, the injected HTML executes in their browser, potentially leading to credential theft, malware delivery, or further social engineering attacks.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in Rocket.Chat's Omnichannel livechat module. The REST API endpoint POST /api/v1/livechat/visitor accepts an unauthenticated, unsanitized name field from visitors and stores it directly in the database without validation or escaping. When a support agent views the Omnichannel queue in the side panel (InquireSidePanelItem.tsx), the visitor name is rendered using React's dangerouslySetInnerHTML function, bypassing XSS protections and allowing arbitrary HTML and JavaScript injection. No authentication is required to create a visitor or submit a malicious name; an attacker simply needs to craft a livechat request with an injected payload. The injected content executes with the agent's privileges when they access the queue, enabling social engineering, credential harvesting, or malware distribution. The fix (merged Aug 18, 2026 in PR #41595) adds proper sanitization of special characters in the side panel rendering.
Affected products
- Rocket.Chat Rocket.Chat before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15
Timeline
- 2026-08-21: disclosed: CVE-2026-65644 published on NVD
- 2026-08-18: patched: Fix merged in GitHub PR #41595 (add-sanitization-sidepanelitem)