Is CVE-2026-65644 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65644 being exploited in the wild.

How severe is CVE-2026-65644?

High severity, with a CVSS score of 7.5, published 21 August 2026.

Which products and versions are affected?

Rocket.Chat before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15.

Is there a fix for CVE-2026-65644?

A patch was published on 2026-08-18: Fix merged in GitHub PR #41595 (add-sanitization-sidepanelitem) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65644 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-65644?

Check whether you run Rocket.Chat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65644: Rocket.Chat Omnichannel queue stored XSS via visitor name

CVE-2026-65644 · Severity: high · CVSS 7.5 · Published 2026-08-21

Rocket.Chat's Omnichannel feature allows unauthenticated users to create livechat visitor accounts with arbitrary names that are never sanitized. These names are later displayed in the agent's queue panel using unsafe HTML rendering, enabling an attacker to inject malicious links or content that appears to support staff. When an agent views the queue, the injected HTML executes in their browser, potentially leading to credential theft, malware delivery, or further social engineering attacks.

Technologies: Rocket.Chat. Vendors: Rocket.Chat.

Quick answers

Is CVE-2026-65644 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65644 being exploited in the wild.
How severe is CVE-2026-65644?: High severity, with a CVSS score of 7.5, published 21 August 2026.
Which products and versions are affected?: Rocket.Chat before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15.
Is there a fix for CVE-2026-65644?: A patch was published on 2026-08-18: Fix merged in GitHub PR #41595 (add-sanitization-sidepanelitem) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65644 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-65644?: Check whether you run Rocket.Chat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in Rocket.Chat's Omnichannel livechat module. The REST API endpoint POST /api/v1/livechat/visitor accepts an unauthenticated, unsanitized name field from visitors and stores it directly in the database without validation or escaping. When a support agent views the Omnichannel queue in the side panel (InquireSidePanelItem.tsx), the visitor name is rendered using React's dangerouslySetInnerHTML function, bypassing XSS protections and allowing arbitrary HTML and JavaScript injection. No authentication is required to create a visitor or submit a malicious name; an attacker simply needs to craft a livechat request with an injected payload. The injected content executes with the agent's privileges when they access the queue, enabling social engineering, credential harvesting, or malware distribution. The fix (merged Aug 18, 2026 in PR #41595) adds proper sanitization of special characters in the side panel rendering.

Affected products

Rocket.Chat Rocket.Chat before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15

Timeline

2026-08-21: disclosed: CVE-2026-65644 published on NVD
2026-08-18: patched: Fix merged in GitHub PR #41595 (add-sanitization-sidepanelitem)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.