CVE-2022-23656 Cross-site scripting vulnerability in Zulip Server

Medium 4.6 Published 2 Mar 2022 Updated 23 Apr 2025

An attacker can execute arbitrary JavaScript in a victim's browser via a crafted full name on the recent topics page in Zulip Server.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2022-23656?

CVE-2022-23656 is a medium-severity cross-site scripting vulnerability in zulip, published on 2 Mar 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Zulip is an open source team chat app. The `main` development branch of Zulip Server from June 2021 and later is vulnerable to a cross-site scripting vulnerability on the recent topics page. An attacker could maliciously craft a full name for their account and send messages to a topic with several participants; a victim who then opens an overflow tooltip including this full name on the recent topics page could trigger execution of JavaScript code controlled by the attacker. Users running a Zulip server from the main branch should upgrade from main (2022-03-01 or later) again to deploy this fix.

Weakness: CWE-79

Which versions are affected by CVE-2022-23656?

It affects 1 product.

Products include Zulip Zulip Server.

How do I fix CVE-2022-23656?

No fix has been published for CVE-2022-23656 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-23656 being exploited?

There is no known exploitation of CVE-2022-23656 in the wild and no public exploit code.

Sources

Also known as GHSA-fc77-h3jc-6mfv.