CVE-2022-46180

MEDIUM 5.4CVE-2022-46180 · Published 04/01/2023 · updated 17/06/2026

In short

CVE-2022-46180 is a MEDIUM (CVSS 5.4) vulnerability affecting mermaid (discourse).
Chance of exploitation in the next 30 days (EPSS): 0.49%, higher than 42.2% of all vulnerabilities.
Fix: update to 1.1.0 or later.

Package	Affected versions	Patched versions
mermaid discourse	`≥ 1.0.0, < 1.1.0`	`1.1.0`

Description

Discourse Mermaid (discourse-mermaid-theme-component) allows users of Discourse, open-source forum software, to create graphs using the Mermaid syntax. Users of discourse-mermaid-theme-component version 1.0.0 who can create posts are able to inject arbitrary HTML on that post. The issue has been fixed on the `main` branch of the GitHub repository, with 1.1.0 named as a patched version. Admins can update the theme component through the admin UI. As a workaround, admins can temporarily disable discourse-mermaid-theme-component.

References

discourse/discourse-mermaid-theme-component commit c10bc4a · Patch
discourse/discourse-mermaid-theme-component#14 · Patch
discourse/discourse-mermaid-theme-component security advisory · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free