🎯 New Report #3779690: Stored XSS in Rocket.Chat HTML File Export — Unauthenticated Entry via LiveChat
🔺Severity: Medium
👽 Reporter: olidayw
⭐️ Reputation: 498
🛠 State: resolved
💼 Team: Rocket.Chat
💵 Bounty: null
🕐 Submitted: 2026-06-03
⏰ Disclosed: 2026-07-16 05:02:04
📝 Summary: A vulnerability was discovered in the HTML file export feature of Rocket.Chat. The vulnerability allowed an attacker to inject arbitrary JavaScript code that would execute when the exported HTML file was opened. The root cause was that the application did not properly sanitize or escape user-supplied data before including it in the exported HTML. As a result, an unauthenticated attacker could leverage the vulnerability to perform actions such as data exfiltration and credential phishing.
📂 Report JSON File: 3779690
@hackeronereports