2
CVE-2026-72729
- EPSS 0.28%
- Veröffentlicht 10.08.2026 16:15:13
- Zuletzt bearbeitet 11.08.2026 03:18:01
- CVE-Watchlists
- Unerledigt
Discourse: Stored XSS in discourse-local-dates plugin
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse-local-dates plugin rendered crafted local-date format data as HTML on sites with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerdiscourse
≫
Produkt
discourse
Version
< 2026.1.6
Status
affected
Version
>= 2026.5.0-latest, < 2026.5.2
Status
affected
Version
>= 2026.6.0-latest, < 2026.6.1
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.28% | 0.2 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 2 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
https://github.com/discourse/discourse/security/advisories/GHSA-rw96-2xg7-h54g
https://github.com/discourse/discourse/commit/9768f476ed86ea202440cd2b6245af8a4f94ec69
https://github.com/discourse/discourse/commit/981ba23d33d2e2d98f6690734116af58f2cea938
https://github.com/discourse/discourse/commit/a7e509bfa1aa6288b447503de6ef798c31a62751
https://github.com/discourse/discourse/commit/d5d5055fbdf04d5bd72fcaa7e4257fac5adac049