Medium severity6.1OSV Advisory· Published Mar 26, 2021· Updated Jun 17, 2026
CVE-2021-22886
CVE-2021-22886
Description
Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
110.10.0, 0.10.1, 0.10.2, …+ 10 more
- (no CPE)range: 0.10.0, 0.10.1, 0.10.2, …
- cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*range: <3.8.8
- cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc0:*:*:*:*:*:*
- cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc5:*:*:*:*:*:*
- cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc6:*:*:*:*:*:*
- cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:rc7:*:*:*:*:*:*
- (no CPE)range: <3.11, <3.10.5, <3.9.7, <3.8.8
Patches
Vulnerability mechanics
References
3- github.com/RocketChat/Rocket.Chat/pull/20430nvdPatchThird Party Advisory
- docs.rocket.chat/guides/security/security-updatesnvdVendor Advisory
- hackerone.com/reports/1014459nvdThird Party Advisory
News mentions
0No linked articles in our index yet.