CVE-2024-35234

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, an attacker can execute arbitrary JavaScript on users’ browsers by posting a specific URL containing maliciously crafted meta tags. This issue only affects sites with Content Security Polic (CSP) disabled. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. As a workaround, ensure CSP is enabled on the forum.

• CWE-79
• CWE-79

• https://github.com/discourse/discourse/commit/26aef0c288839378b9de5819e96eac8cf4ea60fdPatch
• https://github.com/discourse/discourse/commit/311b737c910cf0a69f61e1b8bc0b78374b6619d2Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-5chg-hm8c-wc58Third Party Advisory
• https://github.com/discourse/discourse/commit/26aef0c288839378b9de5819e96eac8cf4ea60fdPatch
• https://github.com/discourse/discourse/commit/311b737c910cf0a69f61e1b8bc0b78374b6619d2Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-5chg-hm8c-wc58Third Party Advisory

Published

Jul 3, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-35228Wagtail is an open source content management system built on…5.5
• CVE-2024-35229ZKsync Era is a layer 2 rollup that uses zero-knowledge proo…5.3
• CVE-2024-3523A vulnerability classified as critical was found in Campcode…8.8
• CVE-2024-35230GeoServer is an open source software server written in Java …5.3
• CVE-2024-35231rack-contrib provides contributed rack middleware and utilit…8.6
• CVE-2024-35232github.com/huandu/facebook is a Go package that fully suppor…3.7
• CVE-2024-35235OpenPrinting CUPS is an open source printing system for Linu…6.7
• CVE-2024-35236Audiobookshelf is a self-hosted audiobook and podcast server…4.8
• CVE-2024-35237MIT IdentiBot is an open-source Discord bot written in Node.…7.5
• CVE-2024-35238Minder by Stacklok is an open source software supply chain s…5.3
• CVE-2024-35239Umbraco Commerce is an open source dotnet web forms solution…5.4
• CVE-2024-3524A vulnerability, which was classified as problematic, has be…5.4