VULNERABILITY INTELLIGENCE
CVE-2022-46180
CVSS score5 MEDIUM
EPSS probability0.49%
CISA KEVNot currently listed
Published2023-01-04
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Description
Discourse Mermaid (discourse-mermaid-theme-component) allows users of Discourse, open-source forum software, to create graphs using the Mermaid syntax. Users of discourse-mermaid-theme-component version 1.0.0 who can create posts are able to inject arbitrary HTML on that post. The issue has been fixed on the `main` branch of the GitHub repository, with 1.1.0 named as a patched version. Admins can update the theme component through the admin UI. As a workaround, admins can temporarily disable discourse-mermaid-theme-component.
Weakness classification
- security-advisories@github.com: CWE-74
- nvd@nist.gov: CWE-79
Primary references
- security-advisories@github.com — Patch, Third Party Advisory
- security-advisories@github.com — Patch, Third Party Advisory
- security-advisories@github.com — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory