CVE-2022-39232

    Dashboard / Vulnerabilities / CVE-2022-39232

    CVE-2022-39232

    Published: 29 Sept 2022Last Modified: 12 Aug 2026

    Summary: Discourse vulnerable to incomplete quote causing a topic to crash in the browser

    Details: Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaScript error which will crash the current page in the browser in some cases. Version 2.9.0.beta10 added a fix and tests to ensure incomplete quotes won't break the app. As a workaround, the quote can be fixed via the rails console.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39232.json, https://github.com/discourse/discourse/security/advisories/GHSA-cv64-v73f-7wq5, https://nvd.nist.gov/vuln/detail/CVE-2022-39232, https://github.com/discourse/discourse/commit/eab33af5bf19827527fe79134d865b5c727f6530, https://github.com/discourse/discourse/pull/18311

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- f313276966676f555d0c6918e913673730ae78f4
    Fixed -000c7a3ee3351eb3cd3d4b266855c9b13dfbdd00

    Affected versions

    2.9.0-beta5
    2.9.0-beta6
    2.9.0-beta7
    2.9.0-beta8
    2.9.0-beta9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-39232 | CVE-DB