What is the CVSS score of CVE-2026-33411?

CVE-2026-33411 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Discourse are affected by CVE-2026-33411?

Organizations using topic titles for the solved posts stream. should be aware of moderate risk from CVE-2026-33411, a cross-site scripting vulnerability rated CVSS 5.4.

How to fix or mitigate CVE-2026-33411?

Within 30 days: Identify affected systems running topic titles for the solved posts stream. and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Discourse CVE-2026-33411

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-20 GitHub_M

XSS Discourse

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 20, 2026 - 23:16 vuln.today

CVE Published

Mar 20, 2026 - 22:58 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a potential stored XSS in topic titles for the solved posts stream. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.

AnalysisAI

A stored cross-site scripting (XSS) vulnerability exists in Discourse's solved posts stream feature where unsanitized topic titles can be persisted and executed in the browser context of authenticated users. The vulnerability affects Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, allowing authenticated attackers to inject malicious JavaScript that executes in the browsers of other users viewing the affected topics. While the CVSS score of 5.4 reflects moderate severity with low impact scope and no availability impact, the attack requires user interaction indirectly through viewing a crafted topic title, making real-world exploitation limited to scenarios where attackers have post creation privileges.

Technical ContextAI

This vulnerability represents a classic stored XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) within Discourse's topic rendering pipeline, specifically in the solved posts stream feature. The root cause stems from insufficient input validation and output encoding of topic titles before they are stored in the database and subsequently rendered in the HTML response. Discourse (cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*) is a Node.js-based discussion platform that dynamically generates topic displays; when topic titles containing malicious JavaScript payloads are not properly sanitized during creation or display, the JavaScript executes with the privileges of the viewing user's session. The solved posts stream is a filtered view that aggregates topics marked as solved, making it a concentrated attack surface for XSS injection.

RemediationAI

Immediately upgrade Discourse to version 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later depending on your current version track, following the official upgrade documentation at the GitHub security advisory (https://github.com/discourse/discourse/security/advisories/GHSA-j3mm-ghh2-83x2). As an interim workaround while patching is being planned, ensure that Content Security Policy (CSP) is enabled in your Discourse configuration and has not been relaxed to include unsafe-inline or overly permissive script-src directives, which would amplify XSS impact. Additionally, monitor topic creation activity for suspicious titles containing script tags or event handlers, and consider restricting topic creation permissions to trusted user groups until patching is complete. After patching, audit the database for any existing malicious topic titles in the solved posts stream and remove or sanitize them as needed.