CVE-2026-47733— Rocket.Chat: Missing URL protocol sanitization in ImageElement allows javascript: URLs in markdown images
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| RocketChat | Rocket.Chat | < 8.5.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-47733
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rocket.Chat: Missing URL protocol sanitization in ImageElement allows javascript: URLs in markdown images
Source: CVE Program / CVE List V5
Vulnerability Description
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, the ImageElement component in packages/gazzodown renders user-controlled src values directly into <a href> and <img src> attributes without protocol sanitization. Unlike the analogous LinkSpan component — which uses sanitizeUrl to block javascript:, data:, and vbscript: protocols — ImageElement passes the raw URL through unchanged. An authenticated user can post a markdown image with a javascript: URL that, if clicked on an older browser, would execute arbitrary JavaScript in the viewer's session. This vulnerability is fixed in 8.5.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Rocket.Chat 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
RocketChat rocket.chat是巴西RocketChat公司开源的一款团队协作即时通讯平台。 Rocket.Chat 8.5.0之前版本存在跨站脚本漏洞，该漏洞源于ImageElement组件在渲染用户控制的src值时未进行协议清理，可能导致经过身份验证的用户在旧版本浏览器上通过点击javascript:URL执行任意JavaScript脚本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| RocketChat | Rocket.Chat | < 8.5.0 | - |
II. Public POCs for CVE-2026-47733
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47733
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-47733 (1)
Same Patch Batch · RocketChat · 2026-06-24 · 12 CVEs total
| CVE-2026-45688 | 9.1 CRITICAL | Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML U |
| CVE-2026-45689 | 9.1 CRITICAL | Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User A |
| CVE-2026-45687 | 8.5 HIGH | Rocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMess |
| CVE-2026-55762 | 8.1 HIGH | Rocket.Chat: Any Authenticated User Can Permanently Deregister Workspace from Rocket.Chat |
| CVE-2026-55759 | 7.4 HIGH | Rocket.Chat: Apple Sign-In skips JWT claims validation, allowing expired and cross-audienc |
| CVE-2026-49278 | 6.7 MEDIUM | Rocket.Chat: Livechat Visitor Profile Disclosure Leaks Bearer Token and Enables Visitor Im |
| CVE-2026-45677 | Rocket.Chat: Lack of SAML Signature Check During Logout Could Lead To DoS | |
| CVE-2026-45757 | Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login to | |
| CVE-2026-49277 | Rocket.Chat: OAuth access and refresh tokens remain valid after account deactivation | |
| CVE-2026-46423 | Rocket.Chat: SAML signature validation skipped when IdP certificate field is empty | |
| CVE-2026-55666 | Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth |
IV. Related Vulnerabilities
Same product: Rocket.Chat
Same vendor: RocketChat
- CVE-2026-72919
Rocket.Chat: Broken Access Control in channels.convertToTeam - CVE-2026-72918
Rocket.Chat: Insecure implementation of websocket notificati - CVE-2026-55762
Rocket.Chat: Any Authenticated User Can Permanently Deregist - CVE-2026-55759
Rocket.Chat: Apple Sign-In skips JWT claims validation, allo - CVE-2026-55666
Rocket.Chat: Email Parameter Fallback Leads To Account Takeo
Same weakness: CWE-79
- CVE-2026-75948
Joomla Extension - icagenda.com - Authenticated Stored XSS - CVE-2026-76564
Joomla Extension - phoca.cz - Stored XSS via User-Agent hea - CVE-2026-76569
Joomla Extension - phoca.cz - Reflected XSS via the search G - CVE-2026-76565
Joomla Extension - phoca.cz - Reflected XSS via price_from & - CVE-2026-71368
F-RevoCRM跨站脚本漏洞
V. Comments for CVE-2026-47733
No comments yet