CVE-2021-37633: XSS via d-popover and d-html-popover attribute

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-09 · updated 2026-06-17
Weakness: CWE-79

Description

Discourse is an open source discussion platform. In versions prior to 2.7.8 rendering of d-popover tooltips can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. This issue is patched in the latest `stable` 2.7.8 version of Discourse. As a workaround users may ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.

Affected products

discourse: before 2.7.8; 2.8.0-beta2, 2.8.0-beta3 — fixed in 2.7.8

How to fix

Upgrade to a fixed version: discourse 2.7.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-37633 or the next vulnerability affects your stack