This vulnerability arises from the discourse-graphviz plugin, which allows authenticated users to embed malicious JavaScript in DOT graph definitions that are stored and rendered as SVG. Once an attacker creates a graph containing a javascript: link, the script executes in the browser context of any user who views the graph, enabling theft of session cookies, arbitrary actions, or credential compromise. The weakness maps to CWE-79—stored cross-site scripting.

Affected installations are those running Discourse with the discourse-graphviz plugin on versions prior to 2026.3.0-latest.1, 2026.2.1, or 2026.1.2. All recent releases include a patch that removes the vulnerability. The product is the open-source Discourse discussion platform.

The CVSS base score of 4.4 indicates medium risk, while an EPSS score of less than 1 % suggests a low probability of exploitation. The flaw is not listed in the CISA KEV catalog, and exploitation requires a logged-in user to create or modify a graph; additionally, it only manifests when the site’s content security policy is disabled. Thus the threat is moderate but limited by the need for authenticated access and an insecure configuration.