CVE-2026-27570: 
NixOS vulnerability analysis and mitigation

CVE-2026-27570 is a stored Cross-Site Scripting (XSS) vulnerability in Discourse, an open-source discussion platform, affecting the SharedAiConversation model's onebox method. The vulnerability arises because conversation titles and usernames are rendered directly into HTML without proper sanitization. Affected versions include Discourse 2026.1.0 through 2026.1.1, 2026.2.0, and 2026.3.0-latest (unpatched). It was disclosed on March 19, 2026, with patches released shortly after. The CVSS v3.1 base score is 6.1 (Medium) and the CVSS v4.0 base score is 5.1 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Specifically, the onebox method in plugins/discourse-ai/app/models/shared_ai_conversation.rb interpolated the conversation title and post username directly into an HTML heredoc string without escaping, allowing arbitrary HTML/JavaScript injection. An attacker with low privileges (sufficient to create or share an AI conversation) can craft a malicious conversation title containing a payload such as <script>alert("x")</script> or an <img src=x onerror=...> tag; when another user views the shared conversation onebox, the script executes in their browser. The fix applies ERB::Util.html_escape() to both the title and username fields before HTML interpolation (GitHub Commit, GitHub Advisory).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript that executes in the browsers of other users who view the compromised shared AI conversation. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims, and exposure of sensitive information accessible within the victim's Discourse session. Availability is not impacted, but both confidentiality and integrity are affected with a changed scope, meaning the attack can impact users beyond the attacker's own session (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.047%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to have low-level privileges (ability to create or share AI conversations) and requires a victim to interact with the malicious shared conversation (GitHub Advisory, Feedly).

1. Obtain low-privilege access: Register or log in to a Discourse instance running a vulnerable version (2026.1.0–2026.1.1, 2026.2.0, or 2026.3.0-latest unpatched) with access to the AI bot conversation sharing feature (i.e., membership in a group permitted by ai_bot_public_sharing_allowed_groups).
2. Create a malicious AI conversation: Initiate an AI bot conversation and set or manipulate the conversation topic title to include an XSS payload, e.g., title</a><script>alert("x")</script> or a username containing user"><img src=x onerror=alert(1)>.
3. Share the conversation: Use Discourse's AI conversation sharing feature to generate a shareable onebox link for the malicious conversation.
4. Distribute the link: Send or post the shared conversation link to target users (e.g., via direct message, forum post, or external channel).
5. Payload execution: When a victim views the shared conversation onebox, the unsanitized title or username is rendered into the HTML page, causing the injected script to execute in the victim's browser — enabling session token theft, credential harvesting, or further malicious actions (GitHub Advisory, GitHub Commit).

• Network: Unexpected outbound HTTP requests from victim browsers to attacker-controlled domains shortly after viewing shared AI conversation oneboxes; unusual POST requests to session or authentication endpoints following onebox views.
• Logs: Discourse application logs showing access to shared AI conversation URLs (/shared-ai-conversations/...) by multiple users in a short timeframe; server-side rendering of onebox content containing unescaped HTML special characters (<, >, ") in conversation titles.
• File System: No direct file system artifacts expected for a client-side XSS; however, server logs may capture the malicious title string stored in the database.
• Process/Application: Discourse admin logs showing creation of AI conversations with anomalous titles containing HTML tags or JavaScript syntax; reports from users of unexpected browser behavior (pop-ups, redirects) after viewing shared AI conversations (GitHub Advisory).

Upgrade Discourse to one of the patched versions: 2026.1.2 (for 2026.1.x branch), 2026.2.1 (for 2026.2.x branch), or 2026.3.0-latest.1 (for the latest branch). As an immediate workaround prior to patching, administrators should restrict the ai_bot_public_sharing_allowed_groups site setting to limit which user groups can create or share AI conversations, reducing the attack surface. The patch applies ERB::Util.html_escape() to both the conversation title and post usernames before HTML rendering in the onebox method (GitHub Advisory, GitHub Commit).

The vulnerability was reported by security researcher nlgbao1340 and patched by Discourse maintainers romanrizzi and davidtaylorhq. No significant broader media coverage or notable community commentary beyond the GitHub security advisory has been identified at this time (GitHub Advisory).