CyberRota Analysis
AI-GeneratedDiscourse prior to specified versions is vulnerable to stored cross-site scripting (XSS) due to low-privileged users being able to submit malicious content that executes when viewed by moderators, particularly on sites with altered or disabled default Content Security Policy settings. This vulnerability could lead to unauthorized actions or data exposure, making it critical for organizations using affected versions to prioritize updates to the patched releases. Moderators and administrators of Discourse platforms should take immediate action to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Discourse is an open-source discussion platform. Prior to 026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, a low-privileged user could place crafted content in the moderation review queue that executed stored cross-site scripting when a moderator viewed it on a site with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.