CVE-2026-47733: Rocket.Chat ImageElement Protocol Validation Bypass

Technical summary

The ImageElement component in packages/gazzodown renders markdown image syntax without protocol sanitization on the src attribute passed to <img> and <a href> tags. While Rocket.Chat's analogous LinkSpan component correctly invokes sanitizeUrl() to strip javascript:, data:, and vbscript: protocols, ImageElement bypasses this security control entirely. An authenticated user can inject a markdown image with a malicious protocol—for example )—which, when clicked by a recipient in a vulnerable browser, will execute the embedded script in that viewer's security context. The fix in 8.5.0 applies protocol sanitization to ImageElement, bringing it in line with LinkSpan's existing defenses.

Business impact

This vulnerability enables session hijacking and credential theft within Rocket.Chat conversations. An attacker with platform access can distribute malicious markdown to other users; if those users click the crafted image link, the attacker's JavaScript runs with the victim's permissions, potentially exfiltrating session tokens, performing unauthorized actions, or harvesting sensitive data shared in the chat. The impact is amplified in organizations where Rocket.Chat is used for sensitive communications or where user bases include less security-aware staff. Older browsers and environments with lenient Content Security Policy settings face higher risk.

Affected systems

Rocket.Chat versions prior to 8.5.0 are affected. The vulnerability requires authentication and user interaction, so exposure is limited to internal users or invited participants. Self-hosted and SaaS Rocket.Chat deployments running versions 8.4.x and earlier should be considered at risk. Community-driven integrations and forks that have not backported the fix may also be vulnerable.

Exploitability

Exploitability is moderate. An attacker must be an authenticated user on the platform, and the victim must click the malicious image link for code execution to occur. The reliance on older browser behavior (modern browsers have increasingly strict URL protocol handling) reduces but does not eliminate the risk. No exploit kit or advanced tooling is required—a simple markdown injection suffices. Internal threat actors or users with compromised credentials pose the primary risk vector.

Remediation

Upgrade Rocket.Chat to version 8.5.0 or later. This release patches the ImageElement component to apply protocol sanitization consistent with LinkSpan, blocking javascript:, data:, and vbscript: URLs. Organizations unable to upgrade immediately should audit markdown content for suspicious image links and consider network controls or browser security policies that restrict javascript: protocol execution. Review user access logs for any evidence of click-based exploitation attempts.

Patch guidance

Apply the 8.5.0 release or any subsequent version as soon as practical. Verify the upgrade in a staging environment to confirm backward compatibility with custom markdown extensions or third-party integrations. No configuration workarounds are available; patching is the definitive remediation. Organizations on extended support timelines should contact Rocket.Chat for guidance on backported patches for older release branches.

Detection guidance

Monitor Rocket.Chat logs for markdown containing suspicious URL schemes (javascript:, data:, vbscript:) embedded in image or link syntax. Hunt for image elements in messages posted by users with escalated privileges or those showing lateral movement patterns. Examine browser console logs and CSP violation reports for attempts to execute inline scripts. Network telemetry showing connections initiated from Rocket.Chat browser clients to unexpected external hosts may indicate successful exploitation.

Why prioritize this

While the CVSS score of 4.4 (Medium) reflects the requirement for authentication and user interaction, the attack's simplicity, the likelihood of social engineering, and the sensitivity of data typically flowing through team communication platforms warrants prioritization above the base score. Organizations with highly engaged user bases and those managing sensitive projects should treat this as a higher-priority patch. The vulnerability is not yet in the CISA KEV catalog, but that reflects publication recency rather than actual risk.

Risk score, explained

CVSS 4.4 reflects a Network vector (reachable over the internet), High complexity (limited to older browsers, user interaction required), Low privilege requirement (any authenticated user), Required user interaction, and limited scope of impact (Low confidentiality and integrity, no availability loss). The score appropriately discounts for browser-level mitigations in modern clients, but does not fully account for the social engineering component or the high-value targets in team communication workflows. Security teams should layer this score with organizational context: communication platforms often serve as attack amplifiers, making this a good candidate for above-base-score prioritization in sensitive environments.

Frequently asked questions