# 2.8.14: Security Release

**URL:** https://meta.discourse.org/t/2-8-14-security-release/250763
**Category:** Announcements
**Tags:** release-notes
**Created:** [January 5, 2023, 2:25am UTC](https://meta.discourse.org/t/2-8-14-security-release/250763 "2023-01-05T02:25:21Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![jomaxro](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jomaxro/32/126216_2.png) [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [January 5, 2023, 2:25am UTC](https://meta.discourse.org/t/2-8-14-security-release/250763/1 "2023-01-05T02:25:21Z")

</div>

## Discourse 2.8.14 Stable Release

Discourse strongly recommends that all sites follow the default tests-passed branch of Discourse. The “stable” branch is more focused on _lack of change_ than _lack of bugs_ - all releases, including those on tests-passed and beta are production ready.

### Changes

#### Security:

- BCC active user emails from group SMTP [CVE-2022-46168  
 ](https://github.com/discourse/discourse/security/advisories/GHSA-8p7g-3wm6-p3rm)
- Sanitize PendingPost titles before rendering to prevent XSS [CVE-2023-22454](https://github.com/discourse/discourse/security/advisories/GHSA-ggq4-4qxc-c462)
- Don’t expose user post counts to users who can’t see the topic [CVE-2023-22453](https://github.com/discourse/discourse/security/advisories/GHSA-xx97-6494-p2rv)
- Escape quotes in tag description when rendering [CVE-2023-22455](https://github.com/discourse/discourse/security/advisories/GHSA-5rq6-466r-6mr9)
- Check the length of raw post body to prevent max\_length bypass [CVE-2022-23549](https://github.com/discourse/discourse/security/advisories/GHSA-p47g-v5wr-p4xp)
- Delete email tokens when a user’s email is changed or deleted [CVE-2022-46177](https://github.com/discourse/discourse/security/advisories/GHSA-5www-jxvf-vrc3)
- Use rstrip instead of regex gsub to prevent ReDOS [CVE-2022-23548](https://github.com/discourse/discourse/security/advisories/GHSA-7rw2-f4x7-7pxf)
- Convert send\_digest to a post request [CVE-2022-23546](https://github.com/discourse/discourse/security/advisories/GHSA-q9jp-xv4g-328f)

##### Theme Component Security Updates

The mermaid theme component has also received a security fix. Be sure to update theme components in addition to Discourse.

- Render errors as plain text [CVE-2022-46180](https://github.com/discourse/discourse-mermaid-theme-component/security/advisories/GHSA-8437-hgcm-p3q3)