CVE-2022-31059 Discourse Calendar Event names susceptible to Cross-site Scripting

Medium 6.5 Published 14 Jun 2022 Updated 23 Apr 2025

Attackers can inject malicious scripts via event names in Discourse Calendar if Content Security Policy is disabled or modified.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-31059?

CVE-2022-31059 is a medium-severity cross-site scripting vulnerability in discourse-calendar, published on 14 Jun 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app. Prior to version 1.0.1, parsing and rendering of Event names can be susceptible to cross-site scripting (XSS) attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. This issue is patched in version 1.0.1 of the Discourse Calendar plugin. As a workaround, ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.

Weakness: CWE-79

Which versions are affected by CVE-2022-31059?

It affects 1 product.

Products include Discourse Discourse Calendar.

How do I fix CVE-2022-31059?

No fix has been published for CVE-2022-31059 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-31059 being exploited?

There is no known exploitation of CVE-2022-31059 in the wild and no public exploit code.

Sources

Also known as GHSA-c783-x9vm-xxp5.