CVE-2026-27570

Description

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the onebox method in the SharedAiConversation model renders the conversation title directly into HTML without proper sanitization. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, tighten access by changing the `ai_bot_public_sharing_allowed_groups` site setting.

PUBLISHED Reserved 2026-02-20 | Published 2026-03-19 | Updated 2026-03-24 | Assigner GitHub_M

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

References

github.com/...course/security/advisories/GHSA-hfxw-89hw-vwmv

github.com/...ommit/43a5a60b595f0120e6adfc131f2408508fe341f1

github.com/...ommit/c14f8f52b7999328bd9f8665f2ecfa24dadc4bf1

github.com/...ommit/f2aafa5c7467c94fcd4ebd36785a98e77ca088cc

cve.org (CVE-2026-27570)

nvd.nist.gov (CVE-2026-27570)

Download JSON