Rocket.Chat Cross Site Scripting

It has been noticed that Rocket.Chat has quietly fixed a persistent cross site scripting vulnerability but as of 12/18/2020 no release contains these fixes.

MD5 | 6f5aa53ac928ed8c21480afcef10642f

Rocket.Chat has quietly fixed a stored XSS vulnerability in the following

Exploitation of this vulnerability is very straightforward by manipulating
a message attachment to contain a XSS payload either in the type or the

No release of Rocket.Chat contains these fixes. Users should consider
cherrypicking 96d3155245ec65f681664b48b6dafc94c1ea021c
and 43fe12d775b2329e780a1369a1b2c25070cdcab9 to patch their Rocket.Chat


Related Posts