The vulnerability arises when the SharedAiConversation onebox renders the conversation title directly into HTML without sanitizing user input, enabling an attacker to embed malicious scripts. Once a forged title is stored, any user who views that conversation will execute the script in their browser, potentially granting the attacker access to the user’s session or credentials. This flaw is classified as CWE‑79 – Improper Neutralization of Input During Web Page Generation.

The affected product is Discourse, the open‑source discussion platform. Versions before 2026.3.0‑latest.1, 2026.2.1, and 2026.1.2 are vulnerable. These release lines include a patch that sanitizes the title. No other vendors or products are listed.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score of less than 1% suggests a low chance of exploitation. The vulnerability is not part of CISA’s KEV catalog. Exploitation requires the attacker to be able to create a shared AI conversation – an action that is inferred to be authenticated and performed by a user with sufficient privileges. Once a malicious title is created, the stored XSS can be triggered for any user that visits the conversation page, giving the attacker a broad impact across the site.