cve/2023/CVE-2023-47119.md

### [CVE-2023-47119](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-47119)
![](https://img.shields.io/static/v1?label=Product&message=discourse&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%203.1.3%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-74%3A%20Improper%20Neutralization%20of%20Special%20Elements%20in%20Output%20Used%20by%20a%20Downstream%20Component%20('Injection')&color=brighgreen)

### Description

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some links can inject arbitrary HTML tags when rendered through our Onebox engine. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/BaadMaro/BaadMaro
- https://github.com/BaadMaro/CVE-2023-47119
- https://github.com/kip93/kip93
- https://github.com/nomi-sec/PoC-in-GitHub