CVE-2026-32243: Discourse: Stored XSS in discourse-ai shared conversations onebox
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an attacker with the ability to create shared AI conversations could inject arbitrary HTML and JavaScript via crafted conversation titles. This payload would execute in the browser of any user viewing the onebox preview, potentially allowing session hijacking or unauthorized actions on behalf of the victim. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.3 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.2.2 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32243?
The severity of CVE-2026-32243 is classified as high due to its potential for stored XSS attacks.
How do I fix CVE-2026-32243?
To mitigate CVE-2026-32243, update Discourse to version 2026.1.3 or later, 2026.2.2 or later, or 2026.3.0 or later.
What versions are affected by CVE-2026-32243?
CVE-2026-32243 affects Discourse versions from 2026.1.0 to before 2026.1.3, from 2026.2.0 to before 2026.2.2, and earlier than 2026.3.0.
How does CVE-2026-32243 impact users?
CVE-2026-32243 allows attackers to exploit stored XSS in shared AI conversations, potentially compromising user data.
Who is the vendor for CVE-2026-32243?
The vendor for CVE-2026-32243 is Discourse, the creator of the open-source discussion platform.