An authenticated Zabbix administrator can cause the server or proxy to crash by creating specially crafted JavaScript scripts in preprocessing or script items. The flaw enables an attacker privileged with administrative rights to terminate the monitoring platform, disrupting service availability. The weakness is classified as CWE-248, indicating execution of unsafe fallback code that leads to instability.

Zabbix servers and proxies that allow administrators to configure preprocessing or script items. No specific version details are provided, so any installation with the ability to add JavaScript scripts is potentially affected.

With a CVSS score of 2.1 the vulnerability is considered low severity. EPSS is not available and the issue is not listed in CISA KEV, reducing the likelihood of widespread exploitation. The attack requires prior administrative authentication and the creation of malicious scripts, so it is a local privilege escalation path rather than a remote exploit. Overall, the risk is moderate in environments where administrator accounts are not tightly controlled.