CVE-2023-33186

Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful. The main development branch of Zulip Server from May 2, 2023 and later, including beta versions 7.0-beta1 and 7.0-beta2, is vulnerable to a cross-site scripting vulnerability in tooltips on the message feed. An attacker who can send messages could maliciously craft a topic for the message, such that a victim who hovers the tooltip for that topic in their message feed triggers execution of JavaScript code controlled by the attacker.

• CWE-79
• CWE-79

• https://github.com/zulip/zulip/commit/03cfb3d9fe61c975d133121ec31a7357f0c9e18f
• https://github.com/zulip/zulip/commit/3ca131743b00f42bad8edbac4ef92656d954c629Patch
• https://github.com/zulip/zulip/pull/25370Issue Tracking, Patch
• https://github.com/zulip/zulip/security/advisories/GHSA-4r83-8f94-hrphVendor Advisory
• https://github.com/zulip/zulip/commit/03cfb3d9fe61c975d133121ec31a7357f0c9e18f
• https://github.com/zulip/zulip/commit/3ca131743b00f42bad8edbac4ef92656d954c629Patch
• https://github.com/zulip/zulip/pull/25370Issue Tracking, Patch
• https://github.com/zulip/zulip/security/advisories/GHSA-4r83-8f94-hrphVendor Advisory

Published

May 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-33180Xibo is a content management system (CMS). An SQL injection …6.5
• CVE-2023-33181Xibo is a content management system (CMS). Starting in versi…5.3
• CVE-2023-33182Contacts app for Nextcloud easily syncs contacts from variou…4.3
• CVE-2023-33183Calendar app for Nextcloud easily sync events from various d…4.3
• CVE-2023-33184Nextcloud Mail is a mail app in Nextcloud. A blind SSRF atta…5.3
• CVE-2023-33185Django-SES is a drop-in mail backend for Django. The django_…5.4
• CVE-2023-33187Highlight is an open source, full-stack monitoring platform.…6.5
• CVE-2023-33188Omni-notes is an open source note-taking application for And…5.5
• CVE-2023-33189Pomerium is an identity and context-aware access proxy. With…9.8
• CVE-2023-3319Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2023-33190Sealos is an open source cloud operating system distribution…9.8
• CVE-2023-33191Kyverno is a policy engine designed for Kubernetes. Kyverno …8.8