CVE-2026-27154 — Discourse has XSS when editing a malicious post

CVE-2026-27154

Discourse has XSS when editing a malicious post PUBLISHED

Description (CNA)

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, a user full name can be evaluated as raw HTML when the following settings are set: `display_name_on_posts` => true; and `prioritize_username_in_ux` => false. Editing a post of a malicious user would trigger an XSS. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

Affected (CNA)

Vendor / product	Versions
discourse / discourse	affected < 2025.12.2; affected >= 2026.1.0-latest, < 2026.1.1; affected >= 2026.2.0-latest, < 2026.2.0

CWE

CWE-79

References

https://github.com/discourse/discourse/security/advisories/GHSA-xv43-5gcp-wgw8

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.