CVE-2021-22911: Rocket.Chat improper input sanitization allows unauthenticated NoSQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with unauthenticated network exploitation and public exploit code, plus very high EPSS, makes this an urgent patching priority.

What it is

Rocket.Chat server versions 3.11, 3.12 and 3.13 fail to properly sanitize input, allowing unauthenticated NoSQL injection. The flaw can escalate to remote code execution, making it a serious risk for exposed chat servers.

Impact

An unauthenticated attacker can inject NoSQL operators to manipulate queries and potentially achieve remote code execution on the server. This can lead to full compromise of the Rocket.Chat instance and its data.

Attack surface

The vulnerability is network-reachable with no authentication or user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. It is exploited through crafted input to the Rocket.Chat server.

Exploitation

Public exploit code is referenced in Packetstorm, SonarSource and HackerOne advisories, and EPSS is 0.95242 (99.862 percentile), indicating very high likelihood of exploitation. It is not listed in CISA KEV.

What to do

• Upgrade Rocket.Chat to a patched version newer than 3.13 as soon as possible.
• If immediate upgrade is not possible, restrict network access to the Rocket.Chat server to trusted users only.
• Monitor vendor advisories and apply any hotfixes or configuration hardening guidance for NoSQL injection.
• Review and sanitize all user-supplied input handling in custom integrations or plugins.
• Enable authentication and rate limiting where feasible to reduce exposure.

Detection

• Inspect Rocket.Chat server logs for unusual NoSQL query patterns or errors containing operators like $where, $ne, or $gt.
• Monitor for unexpected outbound connections or process execution from the Rocket.Chat server host.
• Use network detection to identify exploit attempts against Rocket.Chat endpoints based on known public exploit signatures.
• Audit authentication and API access logs for anomalous unauthenticated requests to Rocket.Chat.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.