PT-2026-29305 · Discourse · Discourse

Davidtaylorhq · Published 2026-03-31 · Updated 2026-04-07 · CVE-2026-32243

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 through 2026.3.0.

Description Discourse, an open-source discussion platform, is affected by a flaw that allows an attacker who can create shared AI conversations to inject arbitrary HTML and JavaScript through crafted conversation titles. This injected code executes in the browser of users viewing the onebox preview, potentially leading to session hijacking or unauthorized actions.

Recommendations Update to Discourse version 2026.1.3 or later. Update to Discourse version 2026.2.2 or later. Update to Discourse version 2026.3.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-DISCOURSE-2026-32243

CVE-2026-32243

GHSA-PJC5-8X3W-RFWX

Affected Products

Discourse

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32243.json · Exploit
• https://github.com/discourse/discourse/commit/cac7d618a562ce934f8dbf73cdb70066a4806b4c · Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-pjc5-8x3w-rfwx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32243 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2026-32243 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32243 · Vendor Advisory