CVE-2026-33395 json
Discourse has stored click‑based XSS via Graphviz SVG javascript: links
published 7mo ago modified 2mo ago also BIT-discourse-2026-33395 , EUVD-2026-13402 , GHSA-23c7-gq89-xm5v
- cvss
- 4.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 13%
- public exploits
- 0
- none known
Summary
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the discourse-graphviz plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious JavaScript code through DOT graph definitions. For instances with CSP disabled only. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, disable the graphviz plugin, upgrade to a patched version, or enable a content security policy.
Patch / fix
- bitnami discourse 2026.1.2, 2026.2.1, 2026.3.0
- discourse discourse 2026.1.2, 2026.2.1
Is CVE-2026-33395 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 7mo ago
Exploit prediction
0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.4 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | discourse | >=2026.1.0, <2026.1.2 >=2026.2.0, <2026.2.1 >=2026.3.0, <2026.3.0 |
2026.1.2 2026.2.1 2026.3.0 |
Affected products
- discourse discourse
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/discourse/discourse/commit/0471e68ed0b594bf386e068f228849244b880ef1
patch
-
github.com
/discourse/discourse/commit/0c861df8bea03dcc01b60da6cc7038e6c88de4ee
patch
-
github.com
/discourse/discourse/commit/472f9e1f7855307e489e9eaa6825d5335dfc08b5
patch
-
github.com
/discourse/discourse/security/advisories/GHSA-23c7-gq89-xm5v
mitigation, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-33395
web
Sources
- CVE List CVE-2026-33395
- NVD CVE-2026-33395
- OSV BIT-discourse-2026-33395
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.