Cross-site scripting in Discourse - #VU140660
Published: August 1, 2026
Vulnerability identifier: #VU140660
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to inject arbitrary HTML.
The vulnerability exists due to improper neutralization of special elements in PrettyText.format_for_email when reparsing cooked attribute values as markup. A remote user can supply crafted attribute content to inject arbitrary HTML.
The issue involves cooked attribute text being decoded and then reinterpreted as HTML during email formatting.
Affected software
Discourse
Remediation
Install security update from vendor's website.
Discourse - addressed in versions 2026.1.7, 2026.6.2, 2026.7.1