PT-2026-26705 · Discourse · Discourse

Jomaxro · Published 2026-03-20 · Updated 2026-03-27 · CVE-2026-33411

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2

Description Discourse, an open-source discussion platform, is affected by a potential stored Cross-Site Scripting (XSS) issue in topic titles within the solved posts stream. This allows for the injection of malicious scripts that can be executed in the context of other users' browsers.

Recommendations Update to Discourse version 2026.3.0-latest.1 or later. Update to Discourse version 2026.2.1 or later. Update to Discourse version 2026.1.2 or later. Ensure the Content Security Policy is enabled and has not been modified in a way that increases vulnerability to XSS attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-DISCOURSE-2026-33411

CVE-2026-33411

GHSA-J3MM-GHH2-83X2

Affected Products

Discourse

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33411.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-j3mm-ghh2-83x2 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2026-33411 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33411 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33411 · Vendor Advisory
• https://twitter.com/CVEnew/status/2035262118400856408 · Twitter Post