Unrated severityNVD Advisory· Published Oct 6, 2022· Updated Apr 23, 2025

Discourse-chat plugin susceptible to XSS in channel name and description

CVE-2022-39279

Description

discourse-chat is a plugin for the Discourse message board which adds chat functionality. In versions prior to 0.9 some places render a chat channel's name and description in an unsafe way, allowing staff members to cause an cross site scripting (XSS) attack by inserting unsafe HTML into them. Version 0.9 has addressed this issue. Users are advised to upgrade. There are no known workarounds for this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Discourse (software)/Discoursellm-fuzzy2 versions
<0.9+ 1 more
- (no CPE)range: <0.9
- (no CPE)range: < 0.9

Patches

Vulnerability mechanics

References

github.com/discourse/discourse-chat/commit/25737733af48e5b9fa60b0561d7fde14bea13ccemitre
github.com/discourse/discourse-chat/security/advisories/GHSA-qp62-8m3c-9jgjmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000