CVE-2023-43659

Discourse is an open source platform for community discussion. Improper escaping of user input allowed for Cross-site Scripting attacks via the digest email preview UI. This issue only affects sites with CSP disabled. This issue has been patched in the 3.1.1 stable release as well as the 3.2.0.beta1 release. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled on the forum.

• CWE-79

• https://developer.mozilla.org/en-US/docs/Web/HTTP/CSPThird Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-g4qg-5q2h-m8phVendor Advisory
• https://developer.mozilla.org/en-US/docs/Web/HTTP/CSPThird Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-g4qg-5q2h-m8phVendor Advisory

Published

Oct 16, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-43652JumpServer is an open source bastion host. As an unauthentic…9.1
• CVE-2023-43654TorchServe is a tool for serving and scaling PyTorch models …9.8
• CVE-2023-43655Composer is a dependency manager for PHP. Users publishing a…8.8
• CVE-2023-43656matrix-hookshot is a Matrix bot for connecting to external s…9
• CVE-2023-43657discourse-encrypt is a plugin that provides a secure communi…6.1
• CVE-2023-43658dicourse-calendar is a plugin for the Discourse messaging pl…6.1
• CVE-2023-4366Use after free in Extensions in Google Chrome prior to 116.0…8.8
• CVE-2023-43660Warpgate is a smart SSH, HTTPS and MySQL bastion host for Li…8.1
• CVE-2023-43661Cachet, the open-source status page system. Prior to the 2.4…8.8
• CVE-2023-43662ShokoServer is a media server which specializes in organizin…8.6
• CVE-2023-43663PrestaShop is an Open Source e-commerce web application. In …4.3
• CVE-2023-43664PrestaShop is an Open Source e-commerce web application. In …4.3