discourse-ai vulnerabilities

2 known vulnerabilities in discourse-ai from Discourse. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.0 Critical severity

  discourse-ai: Improper Neutralization of Input During Web Page Generation

  CVE-2024-54142Jan 14, 2025Discourse

  Discourse AI is a Discourse plugin which provides a number of AI features. When sharing Discourse AI Bot conversations into posts, if the conversation had HTML entities those could leak into the Discourse application when a user visited a post with a onebox to

• 7.2 High severity

  discourse-ai: Server-Side Request Forgery

  CVE-2024-23654Feb 21, 2024Discourse

  discourse-ai is the AI plugin for the open-source discussion platform Discourse. Prior to commit 94ba0dadc2cf38e8f81c3936974c167219878edd, interactions with different AI services are vulnerable to admin-initiated SSRF attacks. Versions of the plugin that inclu