Is there a patch available for CVE-2026-32243?

Yes, a patch is available for CVE-2026-32243. Update the affected software to the latest version immediately.

Discourse CVE-2026-32243

Q: What is the CVSS score of CVE-2026-32243?

CVE-2026-32243 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17549 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-31 GitHub_M

XSS Discourse

5.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.1.3,2026.3.0,2026.2.2

EUVD ID Assigned

Mar 31, 2026 - 18:16 euvd

EUVD-2026-17549

Analysis Generated

Mar 31, 2026 - 18:16 vuln.today

CVE Published

Mar 31, 2026 - 17:39 nvd

MEDIUM 5.3

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an attacker with the ability to create shared AI conversations could inject arbitrary HTML and JavaScript via crafted conversation titles. This payload would execute in the browser of any user viewing the onebox preview, potentially allowing session hijacking or unauthorized actions on behalf of the victim. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

AnalysisAI

Stored cross-site scripting (XSS) in Discourse allows authenticated users with conversation creation privileges to inject arbitrary HTML and JavaScript via crafted AI conversation titles, executing malicious payloads in the browsers of users viewing onebox previews and potentially enabling session hijacking or unauthorized actions. Affects Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0-beta; patched versions 2026.1.3, 2026.2.2, and 2026.3.0 are available. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The vulnerability stems from insufficient input sanitization in the onebox preview rendering system for shared AI conversations (CWE-79: Improper Neutralization of Input During Web Page Generation). When a user creates a shared AI conversation, the conversation title is processed and displayed in onebox previews - rich preview cards that appear when links to content are shared. The vulnerability allows attackers to bypass output encoding by crafting specially-formed conversation titles containing HTML and JavaScript payloads. These payloads execute with the privileges of the viewing user in their browser context, since the preview rendering does not properly neutralize script content before display. The attack leverages Discourse's onebox preview functionality, which is designed to generate rich contextual previews but fails to sanitize untrusted input from conversation metadata.

RemediationAI

Upgrade immediately to patched versions: Discourse 2026.1.3 or later for the 2026.1 branch, Discourse 2026.2.2 or later for the 2026.2 branch, or Discourse 2026.3.0 or later for the 2026.3 branch. The upstream fix is available via commit cac7d618a562ce934f8dbf73cdb70066a4806b4c (https://github.com/discourse/discourse/commit/cac7d618a562ce934f8dbf73cdb70066a4806b4c). As a workaround prior to patching, administrators may temporarily restrict conversation creation permissions to trusted users only or disable AI conversation sharing features if available in their Discourse instance configuration. Refer to the security advisory at https://github.com/discourse/discourse/security/advisories/GHSA-pjc5-8x3w-rfwx for detailed patching instructions.