The vulnerability allows an attacker to inject arbitrary HTML and JavaScript into the title of a shared AI conversation in Discourse, leading to stored client-side script execution when other users view the onebox preview. By executing malicious code in the victim’s browser, an attacker could hijack sessions or perform unauthorized actions on behalf of the viewer. The weakness is a classic stored cross-site scripting flaw identified as CWE-79.

Discourse, the open-source discussion platform, is affected. Versions from 2026.1.0 up to but not including 2026.1.3, from 2026.2.0 up to but not including 2026.2.2, and from 2026.3.0 up to but not including 2026.3.0 contain the flaw; the issue was fixed in 2026.1.3, 2026.2.2, and 2026.3.0 respectively.

The CVSS base score is 5.3, indicating a medium severity. The EPSS probability is less than 1 %, suggesting a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need the ability to create and share AI conversations, so the threat is limited to users with that permission. Once an attacker supplies a malicious conversation title, the payload executes in every browser that renders the onebox, giving attackers a client-side attack surface.