High severity7.4NVD Advisory· Published Aug 9, 2021· Updated Jun 17, 2026
CVE-2021-37633
CVE-2021-37633
Description
Discourse is an open source discussion platform. In versions prior to 2.7.8 rendering of d-popover tooltips can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. This issue is patched in the latest stable 2.7.8 version of Discourse. As a workaround users may ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*range: <2.7.8
- cpe:2.3:a:discourse:discourse:2.8.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:discourse:discourse:2.8.0:beta3:*:*:*:*:*:*
- (no CPE)range: <2.7.8
- (no CPE)range: < 2.7.8
Patches
Vulnerability mechanics
References
2- github.com/discourse/discourse/commit/38199424bc840d2ef002cd1e9bffdbb99191eb47nvdPatchThird Party Advisory
- github.com/discourse/discourse/security/advisories/GHSA-v3v8-3m5w-pjp9nvdThird Party Advisory
News mentions
0No linked articles in our index yet.