CyberRota Analysis
AI-GeneratedDiscourse's open-source discussion platform is vulnerable due to insufficient SVG sanitization in user-uploaded content, which can lead to cross-site scripting (XSS) when users access specific URLs. This vulnerability affects versions prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, and poses a medium risk to user security. Organizations using affected versions should prioritize updating to the latest releases to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, insufficient SVG sanitization in upload and user avatar handling could lead to cross-site scripting when a user visited specific URLs that are not normally part of community browsing. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Related CVEs
Other vulnerabilities affecting the same vendor(s)