Security fixes for Discourse: XSS, Privilege Escalation, and Data Disclosure

Vulnerability Overview The webpage screenshot displays a Pull Request (PR) on GitHub, titled "Security fixes for release/2026.6 #42094". This PR contains multiple security fixes aimed at addressing various security vulnerabilities within the Discourse platform. Impact Scope These security vulnerabilities affect multiple aspects of the Discourse platform, including but not limited to: Hidden Tag Name Exposure: Hidden tag names are exposed via the category serializer. XSS Vulnerability: Cross-Site Scripting (XSS) is stored in post operations through unescaped actor names. Data Leakage: Shared draft titles and summaries are leaked through group posts. Cache Poisoning: Stored XSS is executed via color scheme cookies. JSON ID Leakage: The first post summary is leaked in the QA schema JSON-ID. Privilege Escalation: Private Messages (PMs) are remapped to targets they are permitted to access. AI Response Leakage: AI response streams are delivered to Private Message (PM) participants. Template Endpoint Leakage: Template endpoints expose hidden tag names. Duplicate Lookup Leakage: Restricted topic titles are leaked through duplicate lookups via caching. Anonymous Sidebar Serialization: The anonymous sidebar serializer exposes descriptions. Onebox Domain Blacklist Bypass: The Onebox domain blacklist is bypassed via case-sensitive comparison. Chat Transcript Leakage: Stored XSS occurs in chat transcripts due to unescaped usernames in Rich Text. Log Injection: Stored XSS is injected into the staff UI via staff action logs. HTML Injection: Prevention of HTML injection during discourse-local-dates rendering. Tag Cleanup: Cleaning of tag HTML in the moderation timeline. Message Disclosure: Private chat threat messages are disclosed via chat channels. Visibility Leakage: Topic visibility is exposed in the reviewable score serializer. Remediation Measures The PR addresses the aforementioned security vulnerabilities through the following measures: 1. Hidden Tag Name Exposure: Hides tag names via the category serializer. 2. XSS Fix: Escapes actor names in post operations. 3. Data Leakage Fix: Restricts access to shared draft titles and summaries. 4. Cache Poisoning Fix: Prevents stored XSS via color scheme cookies. 5. JSON ID Leakage Fix: Hides the first post summary in the QA schema JSON-ID. 6. Privilege Escalation Fix: Limits the scope of Private Message (PM) remapping. 7. AI Response Leakage Fix: Prevents AI response streams from being sent to Private Message (PM) participants. 8. Template Endpoint Leakage Fix: Hides hidden tag names exposed by template endpoints. 9. Duplicate Lookup Leakage Fix: Prevents leaked restricted topic titles via duplicate lookups. 10. Anonymous Sidebar Serialization Fix: Prevents the anonymous sidebar serializer from exposing descriptions. 11. Onebox Domain Blacklist Bypass Fix: Resolves the bypass of the Onebox domain blacklist via case-sensitive comparison. 12. Chat Transcript Leakage Fix: Escapes chat transcript usernames in Rich Text. 13. Log Injection Fix: Prevents staff action logs from injecting stored XSS into the staff UI. 14. HTML Injection Fix: Prevents HTML injection during discourse-local-dates rendering. 15. Tag Cleanup Fix: Cleans tag HTML in the moderation timeline. 16. Message Disclosure Fix: Prevents the disclosure of private chat threat messages via chat channels. 17. Visibility Leakage Fix: Hides topic visibility in the reviewable score serializer. POC Code or Exploit Code No specific POC (Proof of Concept) code or exploit code is included in the page. Summary This Pull Request contains multiple security fixes designed to address various security vulnerabilities within the Discourse platform, including XSS, data leakage, and privilege escalation. The remediation measures cover multiple aspects to ensure the platform's security.

Goal Reached Thanks to every supporter — we hit 100%!

Security fixes for Discourse: XSS, Privilege Escalation, and Data Disclosure

More from this source