Cross-site Scripting via Discourse-ai SharedAiConversation onebox in Discourse
概要
Cross-site Scripting via Discourse-ai SharedAiConversation onebox in Discourse
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Discourse AI is a Discourse plugin which provides a number of AI features. When sharing Discourse AI Bot conversations into posts, if the conversation had HTML entities those could leak into the Discourse application when a user visited a post with a onebox to said conversation. This issue has been addressed in commit 92f122c. Users are advised to update. Users unable to update may remove all groups from ai bot public sharing allowed groups site setting.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com