vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2023-47119

HTML injection in oneboxed links

MEDIUM
6.1
CVSS Score
Published: November 10, 2023 at 03:00 PM UTC
Updated: June 17, 2026 at 06:32 AM UTC
1 product affected across 1 vendorDiscourse

Using discourse by discourse?

Get instant alerts when new vulnerabilities affect discourse - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.1
Exploit prediction
EPSS 0.9%
SSVC
No known exploit

Description

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some links can inject arbitrary HTML tags when rendered through our Onebox engine. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Discourse· Discourse
95%
v < 3.1.3v < 3.2.0v < 3.2.0.beta33.2.0.beta0 ≤ v < 3.2.0.beta33.2.0 beta13.2.0 beta23.2.0.beta0
Affected range stops below 3.1.3, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.2.0, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.2.0.beta3, so it looks safe — our inference, not a vendor statement

References (3)

x_refsource_MISCPatch
Source: [email protected]
https://github.com/discourse/discourse/commit/628b293ff53fb617b3464dd27268aec84388cc09
x_refsource_MISCPatch
Source: [email protected]
https://github.com/discourse/discourse/commit/d78357917c6a917a8a27af68756228e89c69321c
x_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://github.com/discourse/discourse/security/advisories/GHSA-j95w-5hvx-jp5w

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.1MEDIUM[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-74CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card