CVE-2026-32243 in Discourse

Sumário (Inglês)

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an attacker with the ability to create shared AI conversations could inject arbitrary HTML and JavaScript via crafted conversation titles. This payload would execute in the browser of any user viewing the onebox preview, potentially allowing session hijacking or unauthorized actions on behalf of the victim. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Responsável

GitHub_M

Reservar

11/03/2026

Divulgação

31/03/2026

Estado

Confirmado

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
354471	Discourse Script de Site Cruzado	79	Não definido	Correção oficial	CVE-2026-32243

Fontes

• MITRE
• NVD
• CVE Details