{"cve":"CVE-2021-43827","nvd":{"published":"2021-12-14T23:15:08.020","modified":"2026-06-17T04:11:31.367","status":"Modified","description":"discourse-footnote is a library providing footnotes for posts in Discourse. ### Impact When posting an inline footnote wrapped in `<a>` tags (e.g. `<a>^[footnote]</a>`, the resulting rendered HTML would include a nested `<a>`, which is stripped by Nokogiri because it is not valid. This then caused a javascript error on topic pages because we were looking for an `<a>` element inside the footnote reference span and getting its ID, and because it did not exist we got a null reference error in javascript. Users are advised to update to version 0.2. As a workaround editing offending posts from the rails console or the database console for self-hosters, or disabling the plugin in the admin panel can mitigate this issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","score":4.3},"cwes":["CWE-755"],"references":["https://github.com/discourse/discourse-footnote/commit/796617e0131277011207541313522cd1946661ab","https://github.com/discourse/discourse-footnote/security/advisories/GHSA-58vr-c56v-qr57","https://github.com/discourse/discourse-footnote/commit/796617e0131277011207541313522cd1946661ab","https://github.com/discourse/discourse-footnote/security/advisories/GHSA-58vr-c56v-qr57"],"products":["discourse:discourse_footnote"],"source":"nvd","synced_at":"2026-10-19T21:25:41.256909649+00:00"},"epss":{"cve":"CVE-2021-43827","score":0.00829,"percentile":0.57548,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}