5.4

CVE-2026-91120

Discourse: Stored HTML injection in video notification emails

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could create a post for an enabled YouTube, Vimeo, or TikTok provider whose title contained markup, and the email and chat-summary rendering path would place that markup into the output instead of treating it solely as text. Recipients using HTML-capable email clients could see injected content, potentially including event handlers, but the issue did not directly expose a Discourse browser session or affect the forum page itself. Lazy video embeds must be enabled, which is the default configuration. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerdiscourse
≫
Produkt discourse
Version < 2026.8.0
Status affected
Version >= 2026.7.0-latest, < 2026.7.2
Status affected
Version >= 2026.6.0-latest, < 2026.6.3
Status affected
Version >= 2026.1.0-latest, < 2026.1.8
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.089
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://github.com/discourse/discourse/pull/42882
https://github.com/discourse/discourse/security/advisories/GHSA-h7cg-2vww-m45c
https://github.com/discourse/discourse/commit/6bf1cdcb3ae1aa146e1fd953a62046bf4a1f143f
https://github.com/discourse/discourse/commit/8338919df4ecbd0fb85314b762772cc033b764e3
https://github.com/discourse/discourse/commit/e7de8285203a2edf85beff3b951e66aeb7e5dc76
https://github.com/discourse/discourse/commit/ed8b47df80bcc9f0bd70773fc399c9386f9d52dd