Zulip Desktop failed to escape various strings interpolated into the user interface HTML. This could result in code execution when connecting to a maliciously altered Zulip server.

The Zulip security team discovered this issue during internal auditing. Zulip Desktop versions 5.4.2 and earlier are affected.