CVE-2026-33395: 
NixOS vulnerability analysis and mitigation

CVE-2026-33395 is a stored cross-site scripting (XSS) vulnerability in the discourse-graphviz plugin for Discourse, an open-source discussion platform. Authenticated users can inject malicious JavaScript code through DOT graph node URL attributes (e.g., URL="javascript:alert(1)"), which are rendered as unsanitized anchor elements in the resulting SVG output. The vulnerability only affects instances where Content Security Policy (CSP) is disabled. Affected versions include Discourse prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. It carries a CVSS v3.1 base score of 5.4 (Medium) per NVD, or 4.4 (Moderate) per the GitHub Security Advisory (GitHub Advisory).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79). The discourse-graphviz plugin renders DOT language graph definitions into SVG output using Graphviz; prior to the fix, anchor elements (<a>) within the generated SVG were not sanitized, allowing node URL attributes containing javascript: pseudo-scheme URIs to pass through unmodified. When another user views the post and clicks the malicious graph node link, the JavaScript payload executes in their browser context. The fix implements server-side sanitization in plugin.rb via a sanitize_svg_links method that strips any anchor whose href or xlink:href uses a scheme other than http or https, and a database migration rebakes all existing graphviz posts to apply the sanitization retroactively (GitHub Advisory, Patch Commit).

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browsers of other users who click on a malicious graph node link within a Discourse post. Potential consequences include session hijacking, credential theft, unauthorized actions performed on behalf of the victim, and defacement of forum content. The attack is limited to instances with CSP disabled and requires user interaction (a click), constraining its scope, but the stored nature means the payload persists and can affect multiple victims over time (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.03%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account on the target Discourse instance and user interaction from a victim clicking the malicious link (GitHub Advisory).

1. Obtain authenticated access: Register or log in to a target Discourse instance that has the discourse-graphviz plugin enabled and CSP disabled.
2. Craft a malicious DOT graph: Create a new post containing a graphviz block with a node whose URL attribute uses a javascript: URI, for example:

   [graphviz]
   digraph G { a [label="Click me", URL="javascript:alert(document.cookie)"] }
   [/graphviz]

3. Submit the post: Publish the post to a topic visible to other users. The plugin renders the DOT definition into an SVG with an unsanitized <a href="javascript:alert(document.cookie)"> anchor element.
4. Wait for victim interaction: When another authenticated user views the post and clicks the graph node link, the javascript: URI executes in their browser context.
5. Achieve objective: The executed JavaScript can steal session cookies, perform actions as the victim, exfiltrate data, or redirect the user to an attacker-controlled site (GitHub Advisory, Patch Commit).

• Logs: Discourse application logs showing posts containing [graphviz] blocks with URL="javascript: strings in the raw post content; access logs showing requests to post endpoints from accounts that subsequently created graphviz posts.
• File System / Database: Posts in the posts table where the raw column contains [graphviz] and a javascript: URL scheme within a URL= attribute; cooked column containing href="javascript: within a graphviz-svg-render SVG block.
• Network: Outbound requests from victim browsers to attacker-controlled domains immediately after viewing a Discourse post containing a graphviz graph (indicative of data exfiltration via XSS payload).
• Process/Behavior: Unexpected JavaScript execution errors or alerts reported by users after clicking graph nodes in Discourse posts (GitHub Advisory).

Upgrade Discourse to patched versions: 2026.3.0-latest.1, 2026.2.1, or 2026.1.2. The patches implement server-side sanitization of SVG anchor links, restricting href values to http and https schemes only, and include a database migration to rebake existing graphviz posts. If immediate upgrade is not possible, two workarounds are available: (1) disable the discourse-graphviz plugin entirely, or (2) enable Content Security Policy (CSP) on the Discourse instance, which prevents javascript: URI execution even if the malicious anchor is rendered (GitHub Advisory, Patch Commit).