CVE-2023-36473: CSP nonce reuse vulnerability in Discourse

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-13 · updated 2026-06-17
Weakness: CWE-79

Description

Discourse is an open source discussion platform. A CSP (Content Security Policy) nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to completely bypass CSP. The vulnerability is patched in the latest tests-passed, beta and stable branches.

Affected products

discourse: before 3.0.5; 1.1.0-beta1, 1.1.0-beta2, 1.1.0-beta3, 1.1.0-beta4, 1.1.0-beta5, 1.1.0-beta6 (+203) — fixed in 3.0.5

How to fix

Upgrade to a fixed version: discourse 3.0.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-36473 or the next vulnerability affects your stack