Cross-site Scripting in @rocket.chat/livechat

MOYENNE 6.1CVE-2022-21830 · GHSA-hf55-c445-2w97 · Published 01/04/2022 · updated 17/06/2026

En bref

CVE-2022-21830 est une vulnérabilité MOYENNE (CVSS 6.1) touchant livechat (rocket.chat), @rocket.chat/livechat.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.77%, plus élevée que 55.6% des vulnérabilités.
Correctif : mettre à jour vers 1.9.0 ou plus récent.

Package	Affected versions	Patched versions
livechat rocket.chat	`< 1.9.0`	`1.9.0`
@rocket.chat/livechat npm	`< 1.9.0`	`1.9.0`

Description

A blind self XSS vulnerability exists in RocketChat LiveChat versions lower than 1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance.

NVD description

A blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance.

References

nvd.nist.gov/vuln/detail/CVE-2022-21830 · ADVISORY
RocketChat/Rocket.Chat.Livechat#558 · WEB
hackerone.com/reports/1091118 · WEB
RocketChat/Rocket.Chat.Livechat · PACKAGE
RocketChat/Rocket.Chat.Livechat release v1.9.0 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free