CVE-2026-32243

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-32243
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32243.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-32243
Aliases
Published
2026-03-31T17:39:38.318Z
Modified
2026-04-10T05:42:21.066927Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Discourse: Stored XSS in discourse-ai shared conversations onebox
Details

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an attacker with the ability to create shared AI conversations could inject arbitrary HTML and JavaScript via crafted conversation titles. This payload would execute in the browser of any user viewing the onebox preview, potentially allowing session hijacking or unauthorized actions on behalf of the victim. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32243.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/discourse/discourse

Affected ranges

Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
322d3c0ac6a8f133b3f82875e9dbbe310f638c1b
Fixed
b3f024ce9587e678216892cbd967201b2450e197
Database specific 
{
    "versions": [
        {
            "introduced": "2026.1.0-latest"
        },
        {
            "fixed": "2026.1.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
f7cec86997edc21d6074ceb7666f7e2e6e1b1fdf
Fixed
4431801e7b5af883edb430643fdace7608ffb6fb
Database specific 
{
    "versions": [
        {
            "introduced": "2026.2.0-latest"
        },
        {
            "fixed": "2026.2.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
896e810e1b296478bba91559a8fc89a9926f11fe
Fixed
896e810e1b296478bba91559a8fc89a9926f11fe
Database specific 
{
    "versions": [
        {
            "introduced": "2026.3.0-latest"
        },
        {
            "fixed": "2026.3.0"
        }
    ]
}

Affected versions

Other
esr
stable
v2026.*
v2026.1.0
v2026.1.0-latest
v2026.1.1
v2026.1.2
v2026.2.0
v2026.2.0-latest
v2026.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32243.json"