CVE-2022-39232: Discourse vulnerable to incomplete quote causing a topic to crash in the browser

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-09-29 · updated 2026-06-17
Weakness: CWE-20

Description

Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaScript error which will crash the current page in the browser in some cases. Version 2.9.0.beta10 added a fix and tests to ensure incomplete quotes won't break the app. As a workaround, the quote can be fixed via the rails console.

Affected products

discourse: 2.9.0-beta5, 2.9.0-beta6, 2.9.0-beta7, 2.9.0-beta8, 2.9.0-beta9

References

https://github.com/discourse/discourse/commit/eab33af5bf19827527fe79134d865b5c727f6530
https://github.com/discourse/discourse/pull/18311
https://github.com/discourse/discourse/security/advisories/GHSA-cv64-v73f-7wq5
https://github.com/discourse/discourse/commit/eab33af5bf19827527fe79134d865b5c727f6530
https://github.com/discourse/discourse/pull/18311
https://github.com/discourse/discourse/security/advisories/GHSA-cv64-v73f-7wq5

Get alerted when CVE-2022-39232 or the next vulnerability affects your stack