CVE-2022-23656

Zulip is an open source team chat app. The `main` development branch of Zulip Server from June 2021 and later is vulnerable to a cross-site scripting vulnerability on the recent topics page. An attacker could maliciously craft a full name for their account and send messages to a topic with several participants; a victim who then opens an overflow tooltip including this full name on the recent topics page could trigger execution of JavaScript code controlled by the attacker. Users running a Zulip server from the main branch should upgrade from main (2022-03-01 or later) again to deploy this fix.

• CWE-79
• CWE-79

• https://github.com/zulip/zulip/commit/e090027adcbf62737d5b1f83a9618a9500a49321Patch, Third Party Advisory
• https://github.com/zulip/zulip/security/advisories/GHSA-fc77-h3jc-6mfvThird Party Advisory
• https://github.com/zulip/zulip/commit/e090027adcbf62737d5b1f83a9618a9500a49321Patch, Third Party Advisory
• https://github.com/zulip/zulip/security/advisories/GHSA-fc77-h3jc-6mfvThird Party Advisory

Published

Mar 2, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23650Netmaker is a platform for creating and managing virtual ove…8.8
• CVE-2022-23651b2-sdk-python is a python library to access cloud storage pr…4.7
• CVE-2022-23652capsule-proxy is a reverse proxy for Capsule Operator which …8.8
• CVE-2022-23653B2 Command Line Tool is the official command line tool for t…4.7
• CVE-2022-23654Wiki.js is a wiki app built on Node.js. In affected versions…6.5
• CVE-2022-23655Octobercms is a self-hosted CMS platform based on the Larave…5.3
• CVE-2022-23657A remote authentication bypass vulnerability was discovered …10
• CVE-2022-23658A remote authentication bypass vulnerability was discovered …10
• CVE-2022-23659A remote reflected cross site scripting (xss) vulnerability …6.1
• CVE-2022-2366Incorrect default configuration for trusted IP header in Mat…5.3
• CVE-2022-23660A remote authentication bypass vulnerability was discovered …10
• CVE-2022-23661A authenticated remote command injection vulnerability was d…9.1