CVE-2024-43408: Discourse Placeholder Forms has a XSS stopped by CSP

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-20 · updated 2026-06-17
Weakness: CWE-79

Description

Discourse Placeholder Forms will let you build dynamic documentation. Unsanitized and stored user input was injected in the html of the post. The vulnerability is fixed in commit a62f711d5600e4e5d86f342d52932cb6221672e7.

Affected products

discourse-placeholder-theme-component: before a62f711d5600e4e5d86f342d52932cb6221672e7

References

https://github.com/discourse/discourse-placeholder-theme-component/commit/a62f711d5600e4e5d86f342d52932cb6221672e7
https://github.com/discourse/discourse-placeholder-theme-component/security/advisories/GHSA-9wx4-cmv3-g5jw

Get alerted when CVE-2024-43408 or the next vulnerability affects your stack