Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/plugins/poll/assets/javascripts/lib
History
Exact
Sam 5d21dae7d9
 SECURITY: Uncontrolled Resource Consumption in Number Poll Generation (#41141) 
## Summary

The markdown engine generates poll options in an unbounded loop based on
user input, enabling an attacker to trigger massive memory allocation
and CPU usage in the V8 process. This blocks a global mutex and can
cause worker crashes, effectively DoS-ing markdown processing for all
users.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1120
- HackerOne report: https://hackerone.com/reports/3598542

---

🤖 Auto-generated from the patch diff via Patch Triage. Review carefully
before merging.

Co-authored-by: discourse-patch-triage
<272280883+discourse-patch-triage[bot]@users.noreply.github.com>

---------

Co-authored-by: discourse-patch-triage[bot] <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-06-24 15:20:12 +10:00
..
discourse-markdown SECURITY: Uncontrolled Resource Consumption in Number Poll Generation (#41141) 2026-06-24 15:20:12 +10:00
chart-colors.js
even-round.js
rich-editor-extension.js FIX: Preserve all date attributes in rich text editor (#36781) 2025-12-24 14:01:52 +01:00