Medium severity5.4NVD Advisory· Published Oct 6, 2022· Updated Jun 17, 2026
CVE-2022-39270
CVE-2022-39270
Description
DiscoTOC is a Discourse theme component that generates a table of contents for topics. Users that can create topics in TOC-enabled categories (and have sufficient trust level - configured in component's settings) are able to inject arbitrary HTML on that topic's page. The issue has been fixed on the main branch. Admins can update the theme component through the admin UI (Customize -> Themes -> Components -> DiscoTOC -> Check for Updates). Alternatively, admins can temporarily disable the DiscoTOC theme component.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:discourse:discotoc:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:discourse:discotoc:*:*:*:*:*:*:*:*range: <2.1.0
- (no CPE)
- (no CPE)range: < 2.1.0
Patches
Vulnerability mechanics
References
2- github.com/discourse/DiscoTOC/commit/f80c215a283cd045d2a371403e6eba88b2911192nvdPatchThird Party Advisory
- github.com/discourse/DiscoTOC/security/advisories/GHSA-m44p-w923-w32hnvdThird Party Advisory
News mentions
0No linked articles in our index yet.