Rocket.Chat · Report #1967109
Rocket.Chat Desktop client fails to open browser on 3rd party external actions from PDF documents
Validstatus
lowseverity
11upvotes
11 Jul 2024disclosed
Summary
A persistent Cross-Site Scripting (XSS) vulnerability has been identified in the Rocket.Chat Electron desktop application affecting 6.3.4 and older versions, which can be exploited through the upload and subsequent user interaction with files containing specially crafted links.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.