VYPR
← All advisories
High severity8.2NVD Advisory· Published May 30, 2023· Updated Jun 17, 2026

CVE-2023-33186

CVE-2023-33186

Description

Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful. The main development branch of Zulip Server from May 2, 2023 and later, including beta versions 7.0-beta1 and 7.0-beta2, is vulnerable to a cross-site scripting vulnerability in tooltips on the message feed. An attacker who can send messages could maliciously craft a topic for the message, such that a victim who hovers the tooltip for that topic in their message feed triggers execution of JavaScript code controlled by the attacker.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5
  • Zulip/Zulip Server3 versions
    cpe:2.3:a:zulip:zulip_server:7.0:beta1:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:zulip:zulip_server:7.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:zulip:zulip_server:7.0:beta2:*:*:*:*:*:*
    • (no CPE)range: before main development branch of May 2, 2023, beta versions 7.0-beta1 and 7.0-beta2
  • Zulip/Zulipllm-fuzzy2 versions
    before main development branch of May 2, 2023, beta versions 7.0-beta1 and 7.0-beta2+ 1 more
    • (no CPE)range: before main development branch of May 2, 2023, beta versions 7.0-beta1 and 7.0-beta2
    • (no CPE)range: >= 7.0-beta1, < 7.0-beta3

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.