cve.bz

CVE-2022-46162

9.8 criticalEPSS 1.2%

Critical (9.8) in discourse discourse bbcode. EPSS 1.2% chance of exploitation in the next 30 days.

discourse-bbcode is the official BBCode plugin for Discourse. Prior to commit 91478f5, CSS injection can occur when rendering content generated with the discourse-bccode plugin. This vulnerability only affects sites which have the discourse-bbcode plugin installed and enabled. This issue is patched in commit 91478f5. As a workaround, ensure that the Content Security Policy is enabled and monitor any posts that contain bbcode.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
CWEs
CWE-79, CWE-74
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON