CVE-2024-23834

Discourse is an open-source discussion platform. Improperly sanitized user input could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. The vulnerability is patched in 3.1.5 and 3.2.0.beta5. As a workaround, ensure Content Security Policy is enabled and does not include `unsafe-inline`.

• CWE-79

• https://github.com/discourse/discourse/commit/568d704a94c528b7c2cb0f3512a7b7b606bc3000Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-rj3g-8q6p-63pcVendor Advisory
• https://meta.discourse.org/t/3-1-5-security-and-bug-fix-release/293094Release Notes, Vendor Advisory
• https://meta.discourse.org/t/3-2-0-beta5-add-groups-to-dms-mobile-chat-footer-redesign-passkeys-enabled-by-default-and-more/293093Release Notes, Vendor Advisory
• https://github.com/discourse/discourse/commit/568d704a94c528b7c2cb0f3512a7b7b606bc3000Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-rj3g-8q6p-63pcVendor Advisory
• https://meta.discourse.org/t/3-1-5-security-and-bug-fix-release/293094Release Notes, Vendor Advisory
• https://meta.discourse.org/t/3-2-0-beta5-add-groups-to-dms-mobile-chat-footer-redesign-passkeys-enabled-by-default-and-more/293093Release Notes, Vendor Advisory

Published

Jan 30, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23829aiohttp is an asynchronous HTTP client/server framework for …6.5
• CVE-2024-2383A clickjacking vulnerability exists in zenml-io/zenml versio…6.1
• CVE-2024-23830MantisBT is an open source issue tracker. Prior to version 2…8.3
• CVE-2024-23831LedgerSMB is a free web-based double-entry accounting system…7.5
• CVE-2024-23832Mastodon is a free, open-source social network server based …9.8
• CVE-2024-23833OpenRefine is a free, open source power tool for working wit…7.5
• CVE-2024-23835Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-23836Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-23837LibHTP is a security-aware parser for the HTTP protocol. Cra…7.5
• CVE-2024-23838TrueLayer.NET is the .Net client for TrueLayer. The vulnera…7.5
• CVE-2024-23839Suricata is a network Intrusion Detection System, Intrusion …8.1
• CVE-2024-2384The WooCommerce POS plugin for WordPress is vulnerable to in…4.3