Cross-site scripting in Discourse - CVE-2026-55674
Published: July 29, 2026
Vulnerability identifier: #VU139998
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green
CVE-ID: CVE-2026-55674
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
Discourse
Discourse
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary script in victims' browsers.
The vulnerability exists due to improper neutralization of input during web page generation in the color scheme tag rendering logic when processing crafted color_scheme_id or dark_scheme_id cookie values. A remote attacker can send a specially crafted request with a malicious cookie value to execute arbitrary script in victims' browsers.
The poisoned response can be cached and served to subsequent anonymous visitors, scoped per User-Agent.
How to mitigate CVE-2026-55674
Install security update from vendor's website.