CVE-2026-24050
📋 TL;DR
This stored cross-site scripting (XSS) vulnerability in Zulip allows attackers to inject malicious scripts into group or channel names. When administrators perform user profile actions, these scripts execute in victims' browsers. All Zulip instances running versions 5.0 through 11.4 are affected.
💻 Affected Systems
- Zulip
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as administrators, or deploy malware to users' systems through browser exploitation.
Likely Case
Session hijacking of administrators, unauthorized access to sensitive team data, or defacement of the collaboration platform.
If Mitigated
Limited impact due to required user interaction with malicious objects and typical same-origin policy protections.
🎯 Exploit Status
Requires ability to create groups/channels and administrator interaction with those objects.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.5
Vendor Advisory: https://github.com/zulip/zulip/security/advisories/GHSA-56qv-8823-6fq9
Restart Required: Yes
Instructions:
1. Backup your Zulip instance. 2. Upgrade to Zulip 11.5 using: ./scripts/upgrade-zulip-from-git 11.5. 3. Restart Zulip services: ./scripts/restart-server. 4. Verify upgrade completed successfully.
🔧 Temporary Workarounds
Input Sanitization Enhancement
allImplement additional input validation for group and channel names to reject HTML/JavaScript content.
Content Security Policy
allImplement strict CSP headers to mitigate XSS impact by restricting script execution sources.
🧯 If You Can't Patch
- Restrict group and channel creation permissions to trusted users only.
- Monitor administrator actions for unusual patterns and implement user education about suspicious content.
🔍 How to Verify
Check if Vulnerable:
Check Zulip version: cat /home/zulip/deployments/current/version.py | grep ZULIP_VERSIONCheck Version:
cat /home/zulip/deployments/current/version.py | grep ZULIP_VERSIONVerify Fix Applied:
Confirm version is 11.5 or higher and test that HTML/JavaScript in group names is properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual group/channel name patterns containing script tags
- Administrator session anomalies
Network Indicators:
- Unexpected outbound connections from Zulip server during administrative actions
SIEM Query:
source="zulip.log" AND ("<script>" OR "javascript:" OR "onerror=" OR "onload=")