CVE-2026-47733

MEDIUM 4.4

Rocket.Chat: Missing URL protocol sanitization in ImageElement allows javascript: URLs in markdown images

CVSS Score

4.4

EPSS Score

0.0%

EPSS Percentile

0th

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, the ImageElement component in packages/gazzodown renders user-controlled src values directly into <a href> and <img src> attributes without protocol sanitization. Unlike the analogous LinkSpan component — which uses sanitizeUrl to block javascript:, data:, and vbscript: protocols — ImageElement passes the raw URL through unchanged. An authenticated user can post a markdown image with a javascript: URL that, if clicked on an older browser, would execute arbitrary JavaScript in the viewer's session. This vulnerability is fixed in 8.5.0.

CWE	CWE-79
Vendor	rocketchat
Product	rocket.chat
Published	Jun 24, 2026

Stay Ahead of the Next One

Get instant alerts for rocketchat rocket.chat

Be the first to know when new medium vulnerabilities affecting rocketchat rocket.chat are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

RocketChat / Rocket.Chat

< 8.5.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-vvrf-fq54-q4pr