CVE-2023-22455

Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, tag descriptions, which can be updated by moderators, can be used for cross-site scripting attacks. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy. Versions 2.8.14 and 3.0.0.beta16 contain a patch.

• CWE-79

• https://github.com/discourse/discourse/commit/692329896ac64d8581947e977202c243eef3b5a2Patch, Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-5rq6-466r-6mr9Third Party Advisory
• https://github.com/discourse/discourse/commit/692329896ac64d8581947e977202c243eef3b5a2Patch, Third Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-5rq6-466r-6mr9Third Party Advisory

Published

Jan 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-2245A vulnerability was found in hansunCMS 1.4.3. It has been de…6.3
• CVE-2023-22450 In Advantech WebAccss/SCADA v9.1.3 and prior, there is an…7.2
• CVE-2023-22451Kiwi TCMS is an open source test management system. In versi…8.8
• CVE-2023-22452kenny2automate is a Discord bot. In the web interface for se…6.5
• CVE-2023-22453Discourse is an option source discussion platform. Prior to …5.3
• CVE-2023-22454Discourse is an option source discussion platform. Prior to …6.1
• CVE-2023-22456ViewVC, a browser interface for CVS and Subversion version c…6.1
• CVE-2023-22457CKEditor Integration UI adds support for editing wiki pages …8.8
• CVE-2023-22458Redis is an in-memory database that persists on disk. Authen…5.5
• CVE-2023-2246A vulnerability has been found in SourceCodester Online Pizz…9.8
• CVE-2023-22460go-ipld-prime is an implementation of the InterPlanetary Lin…7.5
• CVE-2023-22461The `sanitize-svg` package, a small SVG sanitizer to prevent…6.1