What is CVE-2021-22911?

CVE-2021-22911 is a critical-severity vulnerability in Rocket.chat, classified under CWE-75. CVSS score: 9.8/10. Published 2021-05-27.

How severe is CVE-2021-22911?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2021-22911 known to be exploited?

37 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Rocket.chat

CVE-2021-22911

A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.

Published 2021-05-27 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.952 (99.9th percentile), scored 2026-10-15.

Very high probability of exploitation in the next 30 days — among the top 0.1% most-likely-to-be-exploited CVEs. 100th percentile — 99.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.952 · newest: 0.952 · change: 0.000

Affected products

Rocket.chat — versions 3.11.0, 3.12.0, 3.13.0
Rocket.chat Server — versions Fixed in: 3.13.2, 3.12.4, 3.11.4

Weakness classification (CWE)

CWE-75

Public proof-of-concept exploits

References

hackerone.com/reports/1130721 (Exploit, Third Party Advisory)
packetstormsecurity.com/files/162997/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Ex… (Exploit, VDB Entry, Third Party Advisory)
packetstormsecurity.com/files/163419/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Ex… (Exploit, VDB Entry, Third Party Advisory)
blog.sonarsource.com/nosql-injections-in-rocket-chat (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2021-22911?: CVE-2021-22911 is a critical-severity vulnerability in Rocket.chat, classified under CWE-75. CVSS score: 9.8/10. Published 2021-05-27.
How severe is CVE-2021-22911?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2021-22911 known to be exploited?: 37 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.