CVE-2022-46180

Discourse Mermaid (discourse-mermaid-theme-component) allows users of Discourse, open-source forum software, to create graphs using the Mermaid syntax. Users of discourse-mermaid-theme-component version 1.0.0 who can create posts are able to inject arbitrary HTML on that post. The issue has been fixed on the `main` branch of the GitHub repository, with 1.1.0 named as a patched version. Admins can update the theme component through the admin UI. As a workaround, admins can temporarily disable discourse-mermaid-theme-component.

• CWE-74
• CWE-79

• https://github.com/discourse/discourse-mermaid-theme-component/commit/c10bc4a08bf865cee20e5d5dffba535762813f0fPatch, Third Party Advisory
• https://github.com/discourse/discourse-mermaid-theme-component/pull/14Patch, Third Party Advisory
• https://github.com/discourse/discourse-mermaid-theme-component/security/advisories/GHSA-8437-hgcm-p3q3Third Party Advisory
• https://github.com/discourse/discourse-mermaid-theme-component/commit/c10bc4a08bf865cee20e5d5dffba535762813f0fPatch, Third Party Advisory
• https://github.com/discourse/discourse-mermaid-theme-component/pull/14Patch, Third Party Advisory
• https://github.com/discourse/discourse-mermaid-theme-component/security/advisories/GHSA-8437-hgcm-p3q3Third Party Advisory

Published

Jan 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-46175JSON5 is an extension to the popular JSON file format that a…8.8
• CVE-2022-46176Cargo is a Rust package manager. The Rust Security Response …5.9
• CVE-2022-46177Discourse is an option source discussion platform. Prior to …8.1
• CVE-2022-46178MeterSphere is a one-stop open source continuous testing pla…8.8
• CVE-2022-46179LiuOS is a small Python project meant to imitate the functio…7.8
• CVE-2022-4618Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-46181Gotify server is a simple server for sending and receiving m…5.4
• CVE-2022-46182Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-46183Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-46184Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-46185Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-46186Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…