CVE-2026-33395

low-risk
Published 2026-03-19

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the discourse-graphviz plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious JavaScript code through DOT graph definitions. For instances with CSP disabled only. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, disable the graphviz plugin, upgrade to a patched version, or enable a content security policy.

Do I need to act?

-
0.04% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.4/10 Medium
NETWORK / HIGH complexity

Affected Products (2)

Affected Vendors

Discourse

References (4)

Patch https://github.com/discourse/discourse/commit/0471e68ed0b594bf386e068f228849244b...
Patch https://github.com/discourse/discourse/commit/0c861df8bea03dcc01b60da6cc7038e6c8...
Patch https://github.com/discourse/discourse/commit/472f9e1f7855307e489e9eaa6825d5335d...
Mitigation https://github.com/discourse/discourse/security/advisories/GHSA-23c7-gq89-xm5v
21
/ 100
low-risk
Severity 14/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 7/34 · Low