Technical impact
Rocket.Chat versions before 8.8.0 (and earlier 8.7.x, 8.6.x, 8.5.x, 8.4.x, 8.3.x, 8.2.x, 8.1.x, 7.10.15) allow an unauthenticated user to POST /api/v1/livechat/visitor with an arbitrary name field that is stored without sanitization. When that name is later displayed in the Omnichannel Queue side panel, the value is rendered using dangerouslySetInnerHTML, which permits an attacker to inject a clickable link to any domain. An agent viewing the queue would therefore see a malicious link that could lead to phishing or other social‑engineering attacks. The weakness is an unsanitized user‑supplied string rendered as HTML (CWE‑79).
Affected Systems
Rocket.Chat platform running any of the following versions: 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, or 7.10.15. All earlier 8.x and 7.x releases are also vulnerable; the fix is included in 8.8.0 and later releases.
Risk and Exploitability
The absence of authentication for the API endpoint means a malicious actor can create a visitor record without credentials, making exploitation trivial. Because the vulnerability exploits client‑side rendering via HTML injection, it can be triggered by any agent who views the queue, regardless of network position. The exploit is straightforward and requires no special configuration. The EPSS score of <1% indicates a low probability of exploitation, and the vulnerability is not listed in CISA KEV, but the CVSS score of 7.5 signals a high severity that poses significant risk through social‑engineering attacks on trusted agents.
