CVE-2022-39232: Discourse

Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days.

Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaScript error which will crash the current page in the browser in some cases. Version 2.9.0.beta10 added a fix and tests to ensure incomplete quotes won't break the app. As a workaround, the quote can be fixed via the rails console.

Affected products

Published 2022-09-29. Last modified 2026-06-17.