CVE-2022-46180
Medium
Description
Discourse Mermaid (discourse-mermaid-theme-component) allows users of Discourse, open-source forum software, to create graphs using the Mermaid syntax. Users of discourse-mermaid-theme-component version 1.0.0 who can create posts are able to inject arbitrary HTML on that post. The issue has been fixed on the `main` branch of the GitHub repository, with 1.1.0 named as a patched version. Admins can update the theme component through the admin UI. As a workaround, admins can temporarily disable discourse-mermaid-theme-component.
SeverityMedium
CVSS5.0
Exploit probability—
Product
Discourse Mermaid
PublishedJan 4, 2023
First seenJan 4, 2023
Weakness typeCWE-74Injection
How to fix
Update
- discourse mermaid1.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| discourse mermaid | 1.0.0 ≤ v < 1.1.0 | 1.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.