Cross-site scripting in Discourse - #VU166156
Published: November 13, 2026
Vulnerability identifier: #VU166156
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to inject persistent HTML into posts and display fake content to viewers.
The vulnerability exists due to improper output escaping in Discourse onebox renderers when embedding external page metadata or site-specific titles and text, although scripts are still removed. A remote user can post a link to controlled content containing crafted metadata, titles, or text to inject styled HTML into the stored onebox and obscure the page with fake content.
Affected software
Discourse
Remediation
Install security update from vendor's website.
Discourse - addressed in versions 2026.7.5, 2026.9.2, 2026.10.1