Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Remote Code Execution in Slack desktop apps + bonusAnalysed#783877 | Valid | Command and Code Injection | Critical | 2020-08-28 | – | 509 |
| URL link spoofingAnalysed#481472 | Valid | Input Validation and Logic | Low | 2020-04-26 | $250 | 362 |
| XSS in gist integrationAnalysed#11073 | Valid | Cross-site Scripting | – | 2019-04-28 | $500 | 157 |
| Ability to join an arbitrary workspace by utilizing a proxy to manipulate invite linksAnalysed#1716016 | Valid | Authentication | Critical | 2023-06-23 | – | 109 |
| Denial of Service via Hyperlinks in PostsAnalysed#1077136 | Valid | Denial of Service | Medium | 2021-10-03 | $1,500 | 109 |
| Team members can trigger arbitrary code execution in Slack Desktop Apps via HTML NotificationsAnalysed#816156 | Valid | Command and Code Injection | High | 2021-05-09 | – | 107 |
| Stored XSS on team.slack.com using new Markdown editor of posts inside the Editing mode and using javascript-URIsAnalysed#132104 | Valid | Cross-site Scripting | – | 2016-09-01 | – | 103 |
| Lack of URL normalization renders Blocked-Previews feature ineffectualAnalysed#1102764 | Valid | Other weaknesses | Medium | 2022-01-16 | $1,000 | 100 |
| Header modification results in disclosure of Slack infra metadata to unauthorized partiesAnalysed#727330 | Valid | Server-Side Request Forgery | Medium | 2021-06-09 | – | 97 |
| SSRF in api.slack.com, using slash commands and bypassing the protections.Analysed#381129 | Valid | Server-Side Request Forgery | Medium | 2019-02-22 | – | 84 |
| Unauthorized access to GovSlackAnalysed#1758174 | Valid | Authentication | Medium | 2023-05-19 | $1,500 | 81 |
| Stored XSS through PDF viewerAnalysed#881557 | Valid | Cross-site Scripting | High | 2022-03-16 | $4,875 | 76 |
| Eavesdropping on private Slack callsAnalysed#184698 | Valid | Authentication | High | 2017-02-08 | $1,000 | 68 |
| Bypass of the SSRF protection in Event Subscriptions parameter.Analysed#386292 | Valid | Server-Side Request Forgery | Medium | 2019-02-22 | – | 52 |
| [Android] Directory traversal leading to disclosure of auth tokensAnalysed#1378889 | Valid | File and Path Handling | High | 2022-02-25 | $3,500 | 50 |
| Linux Desktop application slack executable does not use pie / no ASLRAnalysed#415272 | Valid | Misconfiguration and Insecure Design | Low | 2019-11-17 | $100 | 47 |
| CSS Injection to disable app & potential message exfilAnalysed#679969 | Valid | Input Validation and Logic | Medium | 2019-11-09 | – | 37 |
| Bypass two-factor authenticationAnalysed#121696 | Valid | Authentication | – | 2017-11-18 | – | 36 |
| URL filter bypass in Enterprise GridAnalysed#500348 | Valid | Input Validation and Logic | Low | 2020-02-14 | $100 | 32 |
| Access of Android protected components via embedded intentAnalysed#200427 | Valid | Access Control | Critical | 2017-07-17 | – | 31 |
| Race Condition in account surveyAnalysed#165570 | Valid | Misconfiguration and Insecure Design | – | 2017-11-12 | – | 29 |
| Stored XSS(Cross Site Scripting) In Slack App NameAnalysed#159460 | Valid | Cross-site Scripting | – | 2016-11-22 | $1,000 | 29 |
| Email html InjectionAnalysed#1461194 | Valid | Command and Code Injection | Low | 2022-05-19 | $250 | 28 |
| Rate-limit bypassAnalysed#165727 | Valid | Authentication | – | 2016-11-28 | $500 | 27 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,686 analysed so far), which can be wrong. Data as of 2026-11-15.