Description (CNA)
Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action descriptions. Viewing the affected user activity streams could execute attacker-controlled script in another user's browser. This issue is fixed in version 2026.7.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| discourse / discourse | affected < 2026.7.0 |
CWE
CWE-79
References
- https://github.com/discourse/discourse/security/advisories/GHSA-x6mf-p7cg-69rw
- https://github.com/discourse/discourse/commit/dd786594ddd088657a7e6f9fefba5bd889965fe4
- https://github.com/discourse/discourse/releases/tag/v2026.7.0
ADP enrichment
No English description supplied.
No references supplied.