CVE-2023-46130

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some theme components allow users to add svgs with unlimited `height` attributes, and this can affect the availability of subsequent replies in a topic. Most Discourse instances are unaffected, only instances with the svgbob or the mermaid theme component are within scope. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. As a workaround, disable or remove the relevant theme components.

• CWE-770

• https://github.com/discourse/discourse/commit/6183d9633de873ac2b1e9cdb6ac1c94b4ffae9cbPatch
• https://github.com/discourse/discourse/commit/89a2e60706ce22e4afc463d03af2f34c53291800Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-c876-638r-vfcgVendor Advisory
• https://github.com/discourse/discourse/commit/6183d9633de873ac2b1e9cdb6ac1c94b4ffae9cbPatch
• https://github.com/discourse/discourse/commit/89a2e60706ce22e4afc463d03af2f34c53291800Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-c876-638r-vfcgVendor Advisory

Published

Nov 10, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46125Fides is an open-source privacy engineering platform for man…6.5
• CVE-2023-46126Fides is an open-source privacy engineering platform for man…5.4
• CVE-2023-46127Frappe is a full-stack web application framework that uses P…5.4
• CVE-2023-46128Nautobot is a Network Automation Platform built as a web app…6.5
• CVE-2023-46129NATS.io is a high performance open source pub-sub distribute…7.5
• CVE-2023-4613This vulnerability allows remote attackers to execute arbitr…9.8
• CVE-2023-46131Grails is a framework used to build web applications with th…7.5
• CVE-2023-46132Hyperledger Fabric is an open source permissioned distribute…6.5
• CVE-2023-46133CryptoES is a cryptography algorithms library compatible wit…9.1
• CVE-2023-46134D-Tale is the combination of a Flask back-end and a React fr…9.8
• CVE-2023-46135rs-stellar-strkey is a Rust lib for encode/decode of Stellar…7.5
• CVE-2023-46136Werkzeug is a comprehensive WSGI web application library. In…7.5