Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2022-39232

Discourse vulnerable to incomplete quote causing a topic to crash in the browser

Description

Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaScript error which will crash the current page in the browser in some cases. Version 2.9.0.beta10 added a fix and tests to ensure incomplete quotes won't break the app. As a workaround, the quote can be fixed via the rails console.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

discourse discourse

  • >= 2.9.0.beta5, < 2.9.0.beta10affected

References