CVE-2023-47119

MEDIUM

Discourse < 3.1.3 and < 3.2.0.beta3 - HTML Injection via Onebox Engine

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-47119. PoCs published by BaadMaro.

AI-analyzed exploit summary This repository provides a detailed analysis and proof-of-concept for CVE-2023-47119, an HTML injection vulnerability in Discourse's Onebox engine. It includes technical details, payload examples, and lab setup instructions for testing the vulnerability.

Description

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some links can inject arbitrary HTML tags when rendered through our Onebox engine. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds.

Exploits (1)

nomisec WRITEUP 2 stars
by BaadMaro · poc
https://github.com/BaadMaro/CVE-2023-47119

This repository provides a detailed analysis and proof-of-concept for CVE-2023-47119, an HTML injection vulnerability in Discourse's Onebox engine. It includes technical details, payload examples, and lab setup instructions for testing the vulnerability.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Moderate
Reliability
Reliable
Target: Discourse versions prior to 3.1.3 (stable) and 3.2.0.beta3 (beta/tests-passed)
No auth needed
Prerequisites: Access to a vulnerable Discourse instance · Ability to craft a malicious link with HTML injection
MITRE ATT&CK
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 5.3
EPSS 0.0094
EPSS Percentile 56.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-74 CWE-79
Status published
Products (3)
discourse/discourse 3.2.0 beta1 (2 CPE variants)
discourse/discourse < 3.1.3
discourse/discourse < 3.2.0
Published Nov 10, 2023
Tracked Since Feb 18, 2026