Cross-site scripting in Discourse - #VU140006
Published: July 29, 2026
Vulnerability identifier: #VU140006
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
Discourse
Discourse
Detailed vulnerability description
The vulnerability allows a remote user to execute arbitrary script in the victim's browser.
The vulnerability exists due to cross-site scripting in the discourse-local-dates plugin when rendering stored content. A remote user can inject a crafted payload to execute arbitrary script in the victim's browser.
This vulnerability only affects sites that have modified or disabled the default Content Security Policy, and user interaction is required.
Remediation
Install security update from vendor's website.