Cross-site scripting in Discourse - #VU166155
Published: November 13, 2026
Vulnerability identifier: #VU166155
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to inject misleading links, images, or styling into personal message notification emails.
The vulnerability exists due to improper neutralization of HTML and Markdown in Discourse email generation when rendering participant names or topic titles. A remote user can supply crafted group full names for groups invited to personal messages, user full names when prioritize_username_in_ux is disabled, or topic titles when customized email headers, footers, or preview texts include %{topic_title} to alter emails received by other participants.
Affected software
Discourse
Remediation
Install security update from vendor's website.
Discourse - addressed in versions 2026.7.5, 2026.9.2, 2026.10.1