CVE-2026-65644: Rocket.Chat Livechat XSS Vulnerability

CVE-2026-65644 Overview

CVE-2026-65644 is a stored cross-site scripting (XSS) vulnerability in Rocket.Chat affecting the Omnichannel Livechat feature. The POST /api/v1/livechat/visitor REST API endpoint accepts an unauthenticated, unsanitized name field for Livechat visitors. Rocket.Chat stores this value raw and later renders it through dangerouslySetInnerHTML in the InquireSidePanelItem.tsx component of the Omnichannel Queue side panel. An unauthenticated attacker can inject clickable HTML links pointing to attacker-controlled domains, exposing any agent viewing the queue to phishing and social-engineering payloads. The issue is tracked under CWE-79.

Critical Impact
Unauthenticated attackers can inject arbitrary HTML links into the agent interface, enabling phishing against support staff without any prior access.

Affected Products

Rocket.Chat versions prior to 8.8.0, 8.7.1, 8.6.2, 8.5.3
Rocket.Chat versions prior to 8.4.6, 8.3.8, 8.2.8, 8.1.8
Rocket.Chat versions prior to 7.10.15

Discovery Timeline

2026-08-21 - CVE-2026-65644 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-65644

Vulnerability Analysis

The vulnerability resides in Rocket.Chat's Omnichannel Livechat visitor registration flow. The POST /api/v1/livechat/visitor endpoint is exposed without authentication so that external website visitors can initiate live chat sessions. The name field submitted by the visitor is persisted to storage without HTML encoding or sanitization.

When a support agent opens the Omnichannel Queue side panel, the frontend component InquireSidePanelItem.tsx renders the stored visitor name through React's dangerouslySetInnerHTML property. This bypasses React's default XSS protections and interprets attacker-supplied markup as live DOM. An attacker can submit a name value containing an <a> tag with an arbitrary href and social-engineering text, producing a functional clickable link inside the agent's console.

The attack requires no credentials, no user interaction from the attacker side, and executes in the security context of the agent's Rocket.Chat session.

Root Cause

The root cause is improper neutralization of user-supplied input during web page generation [CWE-79]. Rocket.Chat trusted an unauthenticated, externally reachable field and rendered it as raw HTML in a privileged interface. The combination of missing server-side sanitization and the use of dangerouslySetInnerHTML on the client eliminated both defensive layers.

Attack Vector

An attacker sends an unauthenticated HTTP POST to /api/v1/livechat/visitor with a malicious name payload containing HTML markup. Any agent who subsequently opens the Omnichannel Queue view receives the injected content in their DOM. Clicking the crafted link can redirect the agent to phishing pages, credential harvesters, or malware-delivery domains under attacker control.

See the Rocket.Chat pull request #41595 and HackerOne report #3872858 for the patch and technical writeup.

Detection Methods for CVE-2026-65644

Indicators of Compromise

Livechat visitor records containing HTML tags such as <a, <script, or href= in the name field
Anomalous POST requests to /api/v1/livechat/visitor from unfamiliar source IPs with oversized or markup-laden JSON bodies
Outbound clicks from agent browsers to unexpected external domains originating from the Omnichannel Queue view

Detection Strategies

Inspect Rocket.Chat application logs and MongoDB visitor collections for stored names containing angle brackets or URL-encoded HTML entities.
Deploy a web application firewall (WAF) rule that blocks HTML markup in the name parameter of /api/v1/livechat/visitor.
Correlate agent browser telemetry with visitor creation events to identify link-click chains that originate from queue rendering.

Monitoring Recommendations

Alert on any POST to /api/v1/livechat/visitor where the payload contains <, >, or javascript: substrings.
Track agent workstation DNS and proxy logs for connections to newly registered domains referenced by Livechat entries.
Enable audit logging on Omnichannel administrative actions and visitor record modifications.

How to Mitigate CVE-2026-65644

Immediate Actions Required

Upgrade Rocket.Chat to a fixed release: 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, or 7.10.15.
Review existing Livechat visitor records and remove or sanitize any entries containing HTML markup.
Brief Omnichannel agents on the risk of clicking links inside the queue side panel until patching is complete.

Patch Information

Rocket.Chat resolved the flaw in pull request #41595, which sanitizes visitor-supplied fields on ingestion and removes unsafe rendering in InquireSidePanelItem.tsx. The fix is included in versions 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15.

Workarounds

Place a reverse proxy or WAF in front of Rocket.Chat and reject requests to /api/v1/livechat/visitor whose name field contains HTML control characters.
Temporarily disable the Omnichannel Livechat module in the Rocket.Chat administration console if patching cannot be scheduled immediately.
Restrict access to the Livechat REST endpoint to known upstream ingress paths using network-layer allowlisting.

bash

# Example WAF rule (ModSecurity-style) to block HTML in visitor name
SecRule REQUEST_URI "@streq /api/v1/livechat/visitor" \
  "chain,phase:2,deny,status:400,id:1026065644,\
   msg:'CVE-2026-65644 Rocket.Chat Livechat XSS attempt'"
  SecRule ARGS_JSON:name "@rx <[a-zA-Z/]" "t:none,t:urlDecodeUni"