PT-2026-26433 · Discourse · Discourse-Graphviz+1

Davidtaylorhq · Published 2026-03-19 · Updated 2026-03-27 · CVE-2026-33395

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2

Description Discourse is an open-source discussion platform. The discourse-graphviz plugin contains a stored cross-site scripting (XSS) issue that allows authenticated users to inject malicious JavaScript code through DOT graph definitions. This is only possible on instances where the Content Security Policy (CSP) is disabled.

Recommendations Versions prior to 2026.3.0-latest.1: Disable the graphviz plugin, upgrade to a patched version, or enable a content security policy. Versions prior to 2026.2.1: Disable the graphviz plugin, upgrade to a patched version, or enable a content security policy. Versions prior to 2026.1.2: Disable the graphviz plugin, upgrade to a patched version, or enable a content security policy.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-DISCOURSE-2026-33395

CVE-2026-33395

GHSA-23C7-GQ89-XM5V

Affected Products

Discourse

Discourse-Graphviz

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33395.json · Exploit
• https://github.com/discourse/discourse/commit/472f9e1f7855307e489e9eaa6825d5335dfc08b5 · Patch
• https://github.com/discourse/discourse/commit/0471e68ed0b594bf386e068f228849244b880ef1 · Patch
• https://github.com/discourse/discourse/commit/0c861df8bea03dcc01b60da6cc7038e6c88de4ee · Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-23c7-gq89-xm5v · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2026-33395 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33395 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33395 · Security Note
• https://twitter.com/CVEnew/status/2034891575247950158 · Twitter Post