CVE-2026-27570

Summary

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the onebox method in the SharedAiConversation model renders the conversation title directly into HTML without proper sanitization. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, tighten access by changing the ai_bot_public_sharing_allowed_groups site setting.

Affected Software

VendorProductVersion RangeStatus
discoursediscourse>= 2026.1.0-latest, < 2026.1.2affected
discoursediscourse>= 2026.2.0-latest, < 2026.2.1affected
discoursediscourse= 2026.3.0-latestaffected

Weaknesses

  • CWE-79: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References