Cross-site scripting in Discourse - #VU166160
Published: November 13, 2026
Vulnerability identifier: #VU166160
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to alter notification email appearance or disguise links through injected HTML attributes.
The vulnerability exists due to improper neutralization of post content in Discourse notification email rendering when constructing links from iframe URLs and embedding secure images using supplied dimensions. A remote user can craft posts containing iframe URLs whose origins are permitted by allowed_iframes, or secure images when secure_uploads_allow_embed_images_in_emails is enabled, to inject HTML attributes into emails received by other users.
Affected software
Discourse
Remediation
Install security update from vendor's website.
Discourse - addressed in versions 2026.7.5, 2026.9.2, 2026.10.1