Rocket.Chat Input Handling and XSS Vulnerabilities

Stored HTML injection in Rocket.Chat's Omnichannel Queue panel allows unauthenticated external attackers to render arbitrary, clickable phishing links in the browsers of support agents viewing the queue. All Rocket.Chat deployments with Livechat/Omnichannel enabled and running versions prior to 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, or 7.10.15 are affected. An attacker submitting a crafted visitor name via the unauthenticated POST /api/v1/livechat/visitor REST endpoint can inject arbitrary HTML into the agent-facing side panel UI, enabling targeted social-engineering attacks against customer support staff; no public exploit has been identified at time of analysis, and the EPSS score of 0.18% indicates minimal opportunistic interest.

Private thread content disclosure in Rocket.Chat exposes all private thread parents and their full reply content to any low-privilege authenticated user on instances running versions prior to 8.8.0 across multiple maintained release branches. By substituting a MongoDB operator object (e.g., {"$gt": ""}) for the expected string room-id or thread message-id in the Meteor DDP methods getThreadsList and getThreadMessages, an attacker with any valid account can cause downstream MongoDB queries to fan out across all rooms while the authorization check resolves only to a room the attacker legitimately accesses. No public exploit has been identified at time of analysis, but the technique is straightforward for any developer familiar with DDP WebSocket debugging, and the fix pattern is visible in the public GitHub pull request.