Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 trust raw AI output when showing flagged posts in the Review Queue, rendering it with htmlSafe without proper sanitization. An attacker who can manipulate the AI’s prompt to produce malicious HTML or JavaScript will have that code executed in the browser of any staff member who opens the flagged post. This stored cross‑site scripting allows the attacker to hijack staff sessions, run arbitrary code inside the forum’s web context, and potentially compromise the entire installation.

The vulnerability affects the Discourse open‑source discussion platform, specifically any instance running older releases before 2026.3.0-latest.1, 2026.2.1, or 2026.1.2. The corrected releases include the patch, as evidenced by the commits linked in the advisory.

The CVSS score is 5.1 and the EPSS probability is less than 1 %, indicating a moderate severity with low exploitation likelihood. However, because the flaw permits a prompt‑injection attack that stores malicious payloads for privileged users, a single successful injection grants persistent malicious code execution for any staff member viewing the content. The vulnerability is not listed in CISA’s KEV catalog, but because it directly affects privileged session integrity, timely remediation is critical.