CVE-2024-56328

Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by posting a maliciously crafted onebox url. This issue only affects sites with CSP disabled. This problem has been patched in the latest version of Discourse. Users are...

CVE-2024-56328

CVE-2024-56328 affects Discourse (onebox URL handling). An attacker can cause the execution of arbitrary JavaScript in a user’s browser by posting a maliciously crafted onebox URL, with impact on sites where CSP is disabled. The root cause is the Onebox URL processing in Discourse that allows inl...