CVE-2024-54142 CRITICAL

CVE-2024-54142: Cross-site Scripting via Discourse-ai SharedAiConversation onebox in Discourse

Vendor Discourse
Product discourse-ai
Weakness CWE-79 · XSS
Published January 14, 2025
Last update January 15, 2025
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Discourse AI is a Discourse plugin which provides a number of AI features. When sharing Discourse AI Bot conversations into posts, if the conversation had HTML entities those could leak into the Discourse application when a user visited a post with a onebox to said conversation. This issue has been addressed in commit `92f122c`. Users are advised to update. Users unable to update may remove all groups from `ai bot public sharing allowed groups` site setting.

Key dates

02Disclosure timeline

January 14, 2025 CVE published
January 15, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-39661 WordPress Kubio AI Page Builder plugin <= 2.2.4 - Authenticated Cross Site Scripting (XSS) vulnerability CVE-2025-11283 Frappe LMS Course cross site scripting CVE-2025-13861 HTML Forms – Simple WordPress Forms Plugin <= 1.6.0 - Unauthenticated Stored Cross-Site Scripting CVE-2024-49053 Microsoft Dynamics 365 Sales Spoofing Vulnerability CVE-2025-31760 WordPress SnapWidget Social Photo Feed Widget plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability