VYPR
← All advisories
Medium severity6.1OSV Advisory· Published Jul 11, 2018· Updated Jun 17, 2026

CVE-2018-13878

CVE-2018-13878

Description

An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned (using the @ symbol) in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every user and also admins in the channel.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • RocketChat/Rocket.chatOSV2 versions
    0.10.0, 0.10.1, 0.10.2, …+ 1 more
    • (no CPE)range: 0.10.0, 0.10.1, 0.10.2, …
    • (no CPE)range: <0.65

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.