zrok is a tool for sharing services that, before version 2.0.1, uses Go’s text/template in its proxyUi engine, which performs no HTML escaping. The GitHub OAuth callback handlers in both publicProxy and dynamicProxy embed the attacker‑controlled refreshInterval query parameter directly into an error message when time.ParseDuration fails. That error is rendered without escaping, allowing arbitrary JavaScript to execute in the OAuth server’s origin. This flaw, grounded in CWE‑79 (Cross‑Site Scripting) and CWE‑116 (Improper Encoding), lets an adversary inject code whenever a victim follows a malicious login link and completes the OAuth flow.

The issue affects any openziti zrok deployment running a release earlier than v2.0.1. Users of those versions should verify their installed version and plan an update to the patched release.

The vulnerability carries a CVSS score of 6.1, indicating moderate severity, and currently has no EPSS score available. It is not listed in CISA’s KEV catalog. The likely attack vector requires a victim to click a crafted OAuth URL; after authentication, the callback page executes the injected script in the context of the OAuth provider’s origin, enabling client‑side compromise of the user’s session.