PT-2026-26705 · Discourse · Discourse

Jomaxro · Publicado 2026-03-20 · Atualizado 2026-03-27 · CVE-2026-33411

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2

Description Discourse, an open-source discussion platform, is affected by a potential stored Cross-Site Scripting (XSS) issue in topic titles within the solved posts stream. This allows for the injection of malicious scripts that can be executed in the context of other users' browsers.

Recommendations Update to Discourse version 2026.3.0-latest.1 or later. Update to Discourse version 2026.2.1 or later. Update to Discourse version 2026.1.2 or later. Ensure the Content Security Policy is enabled and has not been modified in a way that increases vulnerability to XSS attacks.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BIT-DISCOURSE-2026-33411

CVE-2026-33411

GHSA-J3MM-GHH2-83X2

Produtos afetados

Discourse

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33411.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-j3mm-ghh2-83x2 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2035262118400856408 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-discourse-2026-33411 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33411 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-33411 · Aviso do Fabricante