The specializedRendering function in Rocket.Chat server before 3.9.2 allows a cross-site scripting (XSS) vulnerability by way of the value parameter.
{
"source": "CPE_RANGE",
"cpe": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "3.9.2"
}
]
}