Critical · published January 14, 2025
🚨 HTML entities leaking into posts can turn your Discourse AI conversations into an unexpected mess! 🔥 Think of it like a restaurant where the chef accidentally slips a note with confidential recipe secrets into a customer’s takeout bag. When the customer shares it, the whole town gets a peek at what was meant to be private! An attacker could exploit this vulnerability to inject malicious content into shared Discourse AI conversations. This means that unsuspecting users might view posts that are not only embarrassing but could also lead to security risks, like revealing sensitive data or executing unwanted scripts. It's a recipe for disaster!
Think of it like a restaurant where the chef accidentally slips a note with confidential recipe secrets into a customer’s takeout bag. When the customer shares it, the whole town gets a peek at what was meant to be private! This vulnerability allows HTML entities from shared Discourse AI Bot conversations to leak into the Discourse application, potentially exposing users to cross-site scripting attacks when they engage with affected posts.
An attacker could exploit this vulnerability to inject malicious content into shared Discourse AI conversations. This means that unsuspecting users might view posts that are not only embarrassing but could also lead to security risks, like revealing sensitive data or executing unwanted scripts. It's a recipe for disaster! Update your Discourse AI plugin immediately with the fix in commit `92f122c`. If you can't update right away, go to your site settings and remove all groups from `ai bot public sharing allowed groups` to halt any further leaking. Don't wait! You've got the power to fix this! Follow these steps, and you'll have your Discourse clean and secure in no time! 🛡️