Read the docs
TI-2023-16363 Aliases CVE-2023-33186

Cross-site scripting vulnerability in Zulip Server development branch via topic tooltip

Priority LOW 37CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful. The main development branch of Zulip Server from May 2, 2023 and later, including beta versions 7.0-beta1 and 7.0-beta2, is vulnerable to a cross-site scripting vulnerability in tooltips on the message feed. An attacker who can send messages could maliciously craft a topic for the message, such that a victim who hovers the tooltip for that topic in their message feed triggers execution of JavaScript code controlled by the attacker.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00617 49th percentileScored 2026-11-07
Fix Fixed zulip (zulip): 7.0-beta3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zulipzulip7.0-beta1 to before 7.0-beta37.0-beta3Patch availableCNA
  • zulip Vendorzulip Affected 7.0-beta1 to before 7.0-beta3 Fixed in 7.0-beta3 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:zulip:zulip_server:7.0:beta1:*:*:*:*:*:*7.0 beta1Vulnerablezulip
cpe:2.3:a:zulip:zulip_server:7.0:beta2:*:*:*:*:*:*7.0 beta2Vulnerablezulip
  • cpe:2.3:a:zulip:zulip_server:7.0:beta1:*:*:*:*:*:* Versions 7.0 beta1 Vulnerable ·zulip
  • cpe:2.3:a:zulip:zulip_server:7.0:beta2:*:*:*:*:*:* Versions 7.0 beta2 Vulnerable ·zulip

Remediation

  • Fix · CNA zulip (zulip) Fixed in 7.0-beta3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-33186

References

Patch 2

Advisory 1

Other 1

  • TI-2024-37129 /api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server CVSS 4.0MEDIUM 6.9
  • TI-2022-06082 Multi-use invitations can grant access to other organizations in Zulip CVSS 3.1CRITICAL 9.8
  • TI-2019-13649 In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process… CVSS 3.1CRITICAL 9.8
  • TI-2025-22659 Zulip Authentication Backend Configuration Bypass CVSS 3.1HIGH 8.2
  • TI-2024-24345 Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers. CVSS 3.1HIGH 7.5
  • TI-2020-11848 Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to… CVSS 3.1HIGH 8.8
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences