CVE-2026-47733— Rocket.Chat: Missing URL protocol sanitization in ImageElement allows javascript: URLs in markdown images
Quick assessment
Affected
RocketChat Rocket.Chat
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
RocketChat rocket.chat是巴西RocketChat公司开源的一款团队协作即时通讯平台。 Rocket.Chat 8.5.0之前版本存在跨站脚本漏洞，该漏洞源于ImageElement组件在渲染用户控制的src值时未进行协议清理，可能导致经过身份验证的用户在旧版本浏览器上通过点击javascript:URL执行任意JavaScript脚本。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| RocketChat | Rocket.Chat | < 8.5.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-47733
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rocket.Chat: Missing URL protocol sanitization in ImageElement allows javascript: URLs in markdown images
Source: CVE Program / CVE List V5
Vulnerability Description
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, the ImageElement component in packages/gazzodown renders user-controlled src values directly into <a href> and <img src> attributes without protocol sanitization. Unlike the analogous LinkSpan component — which uses sanitizeUrl to block javascript:, data:, and vbscript: protocols — ImageElement passes the raw URL through unchanged. An authenticated user can post a markdown image with a javascript: URL that, if clicked on an older browser, would execute arbitrary JavaScript in the viewer's session. This vulnerability is fixed in 8.5.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Rocket.Chat 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
RocketChat rocket.chat是巴西RocketChat公司开源的一款团队协作即时通讯平台。 Rocket.Chat 8.5.0之前版本存在跨站脚本漏洞，该漏洞源于ImageElement组件在渲染用户控制的src值时未进行协议清理，可能导致经过身份验证的用户在旧版本浏览器上通过点击javascript:URL执行任意JavaScript脚本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| RocketChat | Rocket.Chat | < 8.5.0 | - |
|
II. Public POCs for CVE-2026-47733
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47733
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-47733 (1)
Same Patch Batch · RocketChat · 2026-06-24 · 12 CVEs total
| CVE-2026-45688 | 9.1 CRITICAL | Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML U |
| CVE-2026-45689 | 9.1 CRITICAL | Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User A |
| CVE-2026-45687 | 8.5 HIGH | Rocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMess |
| CVE-2026-55762 | 8.1 HIGH | Rocket.Chat: Any Authenticated User Can Permanently Deregister Workspace from Rocket.Chat |
| CVE-2026-55759 | 7.4 HIGH | Rocket.Chat: Apple Sign-In skips JWT claims validation, allowing expired and cross-audienc |
| CVE-2026-49278 | 6.7 MEDIUM | Rocket.Chat: Livechat Visitor Profile Disclosure Leaks Bearer Token and Enables Visitor Im |
| CVE-2026-45677 | Rocket.Chat: Lack of SAML Signature Check During Logout Could Lead To DoS | |
| CVE-2026-45757 | Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login to | |
| CVE-2026-49277 | Rocket.Chat: OAuth access and refresh tokens remain valid after account deactivation | |
| CVE-2026-46423 | Rocket.Chat: SAML signature validation skipped when IdP certificate field is empty | |
| CVE-2026-55666 | Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth |
IV. Related Vulnerabilities
Same product: Rocket.Chat
-
CVE-2026-75575
Rocket.Chat Missing DDP Rate Limit on the sendForgotPassword -
CVE-2026-65645
Rocket.Chat多版本DDP未验证导致信息泄露 -
CVE-2026-65644
Rocket.Chat多个版本REST API反射型XSS漏洞 -
CVE-2026-72919
Rocket.Chat: Broken Access Control in channels.convertToTeam -
CVE-2026-72918
Rocket.Chat: Insecure implementation of websocket notificati
Same vendor: RocketChat
-
CVE-2026-75575
Rocket.Chat Missing DDP Rate Limit on the sendForgotPassword -
CVE-2026-72919
Rocket.Chat: Broken Access Control in channels.convertToTeam -
CVE-2026-72918
Rocket.Chat: Insecure implementation of websocket notificati -
CVE-2026-55762
Rocket.Chat: Any Authenticated User Can Permanently Deregist -
CVE-2026-55759
Rocket.Chat: Apple Sign-In skips JWT claims validation, allo
Same weakness: CWE-79
-
CVE-2026-109392
Pimcore through 2026.3.1 Stored XSS via ExternalImage Field -
CVE-2026-108898
Netis WF2409E Wireless Settings cross site scripting -
CVE-2026-108834
Cairo-dock Glx-Dock Query Parameter ww_page.php cross site s -
CVE-2026-105410
Stored Cross-site Scripting (XSS) vulnerability affecting Tu -
CVE-2026-105409
Stored Cross-site Scripting (XSS) vulnerability affecting Tu
V. Comments for CVE-2026-47733
No comments yet