Zulip’s user profile modal stored malicious script data in group names or channel names when administrators edited user profiles. The script is stored in the server and rendered when the modal is opened, allowing a browser to execute injected code. This client‑side XSS can facilitate session hijacking, credential theft, or phishing attacks if a victim interacts with the affected modal. The weakness is identified as CWE‑79.

The vulnerability affects the Zulip Server product from version 5.0 up to, but not including, 11.5. It is present in all intermediate releases within that range. The affected systems are servers running Zulip based on the Zulip open‑source distribution.

The CVSS score of 1.1 reflects the low severity of this issue; the EPSS score of less than 1% indicates an extremely low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation. Exploitation requires a user to open the profile modal and interact with the injected content, making it a user‑dependent attack vector with limited reach.