---
id: CVE-2023-44389
aliases:
  - GHSA-m755-gxxg-r5qh
  - PYSEC-2023-193
title: >-
  Zope management interface vulnerable to stored cross site scripting via the
  title property
summary: >-
  Zope management interface vulnerable to stored cross site scripting via the
  title property
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N'
vendor: zope
product: zope
ecosystem: pip
affected:
  - 'zope >= 4.0.0, < 4.8.11'
  - 'zope >= 5.0.0, < 5.8.6'
patched:
  - zope 4.8.11
  - zope 5.8.6
published: '2023-10-04'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:58.676789401Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-m755-gxxg-r5qh'
references:
  - url: >-
      https://github.com/zopefoundation/Zope/security/advisories/GHSA-m755-gxxg-r5qh
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-44389'
  - url: >-
      https://github.com/zopefoundation/Zope/commit/21dfa78609ffd8b6bd8143805678ebbacae5141a
  - url: >-
      https://github.com/zopefoundation/Zope/commit/aeaf2cdc80dff60815e3706af448f086ddc3b98d
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/zope/PYSEC-2023-193.yaml
  - url: 'https://github.com/zopefoundation/Zope'
tags:
  - osv
  - pip
epss: 0.00404
epssPercentile: 0.31914
ingestedAt: '2026-09-12T03:13:01.710Z'
---

## Overview

### Impact
The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI) because the title property is displayed unquoted in the breadcrumbs element. All versions of Zope 4 and Zope 5 are affected. 

### Patches
Patches will be released with Zope versions 4.8.11 and 5.8.6.

### Workarounds
Make sure only Manager users can edit and view Zope objects in the Zope Management Interface. This is the default.


## Affected packages

- `zope >= 4.0.0, < 4.8.11`
- `zope >= 5.0.0, < 5.8.6`

## Remediation

Upgrade to a patched release:

- `zope 4.8.11`
- `zope 5.8.6`