EUVD-2026-39089Severity by source
AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Network delivery with authenticated sender (PR:L), legacy-browser precondition raises complexity (AC:H), victim click mandatory (UI:R), cross-user session impact drives S:C with limited C/I.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, the ImageElement component in packages/gazzodown renders user-controlled src values directly into <a href> and <img src> attributes without protocol sanitization. Unlike the analogous LinkSpan component - which uses sanitizeUrl to block javascript:, data:, and vbscript: protocols - ImageElement passes the raw URL through unchanged. An authenticated user can post a markdown image with a javascript: URL that, if clicked on an older browser, would execute arbitrary JavaScript in the viewer's session. This vulnerability is fixed in 8.5.0.
AnalysisAI
Stored XSS in Rocket.Chat's Gazzodown Markdown renderer allows authenticated users to inject javascript: protocol URIs into image elements that execute arbitrary JavaScript in a victim's browser session upon click. The ImageElement component in versions prior to 8.5.0 omits the sanitizeUrl() guard applied by the analogous LinkSpan component, creating an inconsistency that bypasses javascript:, data:, and vbscript: protocol blocking. No public exploit has been identified at time of analysis; exploitation is constrained to legacy browsers and requires victim interaction, reflected in the official CVSS score of 4.4 Medium.
Technical ContextAI
The vulnerability is located in the ImageElement component within Rocket.Chat's gazzodown package - the Markdown rendering library embedded in the platform. The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): user-controlled src values are interpolated directly into <a href> and <img src> HTML attributes without protocol validation. The codebase's LinkSpan component demonstrates the correct pattern by calling sanitizeUrl() to strip dangerous scheme prefixes (javascript:, data:, vbscript:), but ImageElement was never updated with the same guard, leaving a feature-level inconsistency. The CVSS Scope:Changed metric (S:C) reflects that injected script executes in the victim's browser context, allowing cross-user session impact beyond the attacker's own account.
RemediationAI
Vendor-released patch: Rocket.Chat 8.5.0, which applies equivalent protocol sanitization (sanitizeUrl) to the ImageElement component, closing the inconsistency with LinkSpan. Upgrade to 8.5.0 or later following guidance at https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-vvrf-fq54-q4pr. If an immediate upgrade is not feasible, restrict markdown image posting to trusted user roles via Rocket.Chat's built-in permission system (Administration > Permissions), reducing the attacker population at the cost of limiting legitimate image sharing for lower-trust users. Additionally, enforcing a modern browser policy (Chrome, Firefox, or Edge on current stable releases) across all Rocket.Chat clients eliminates the primary execution vector, since those browsers block javascript: protocol in image contexts - however, this is an organizational control that cannot be technically enforced for all endpoints.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today