Discourse vulnerable to Cross-site Scripting through pending post titles descriptions

CVE-2023-22454

What is CVE-2023-22454?

Discourse, a popular open-source discussion platform, contains a vulnerability that allows unprivileged users to exploit pending post titles for cross-site scripting attacks. This flaw is present in versions prior to 2.8.14 on the stable branch and 3.0.0.beta16 on the beta and tests-passed branches. Sites with modified or disabled default Content Security Policies are particularly at risk, as attackers can craft malicious posts which may lead to a full XSS. Immediate patch updates are available for affected versions, and users are strongly advised to upgrade to ensure platform security.

References