UpHeron
All vulnerabilities

Servers and applications

CVE-2023-46238

XSS with User Avatar image

Severity
Medium 5.4
Published
26 Oct 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.38.2, 2.39.2
Also known as
GHSA-954h-jrpm-72pm
Sources
NVD, Project advisories (GitHub)

Description

ZITADEL is an identity infrastructure management system. ZITADEL users can upload their own avatar image using various image types including SVG. SVG can include scripts, such as javascript, which can be executed during rendering. Due to a missing security header, an attacker could inject code to an SVG to gain access to the victim’s account in certain scenarios. A victim would need to directly…

Affected software

SoftwareAffected versions
ZITADELServers and applications · cpe:a:zitadel:zitadel
  • Every version before 2.38.2
  • From 2.39.0 before 2.39.2
ZITADELServers and applications · github:zitadel/zitadel
  • Every version before 2.38.2
  • From 2.39.0 before 2.39.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-46238
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-46238
  • GitHub Advisory Database https://github.com/advisories/GHSA-954h-jrpm-72pm
  • github.com https://github.com/zitadel/zitadel/security/advisories/GHSA-954h-jrpm-72pm