CVE-2022-46180

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Discourse Mermaid (discourse-mermaid-theme-component) allows users of Discourse, open-source forum software, to create graphs using the Mermaid syntax. Users of discourse-mermaid-theme-component version 1.0.0 who can create posts are able to inject arbitrary HTML on that post. The issue has been fixed on the `main` branch of the GitHub repository, with 1.1.0 named as a patched version. Admins can update the theme component through the admin UI. As a workaround, admins can temporarily disable discourse-mermaid-theme-component.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-74 CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-461815.4Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulne CVE-2022-46194.8The Sidebar Widgets by CodeLights plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Extra CSS class’ parameter in v CVE-2022-46218.8Panasonic Sanyo CCTV Network Cameras versions 1.02-05 and 2.03-0x are vulnerable to CSRFs that can be exploited to allow an attacker to pe CVE-2022-46225.4The Login Logout Menu WordPress plugin through 1.3.3 does not validate and escape some of its shortcode attributes before outputting them ba CVE-2022-46235.4The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back CVE-2022-46245.4The GS Logo Slider WordPress plugin before 3.3.8 does not validate and escape some of its shortcode attributes before outputting them back i CVE-2022-46255.4The Login Logout Menu WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them bac CVE-2022-462559.8An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server that enabled remote CVE-2022-462568.8A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages si CVE-2022-462574.3An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub CVE-2022-462586.5An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository-scoped token with read/write a CVE-2022-46265.4The PPWP WordPress plugin before 1.8.6 does not validate and escape some of its shortcode attributes before outputting them back in the page