Description

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted color_scheme_id (or dark_scheme_id) cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered into a color scheme tag without escaping, the attacker could break out of the attribute and inject a tag that bypassed Discourse's nonce-based Content Security Policy, resulting in arbitrary JavaScript execution in visitors' browsers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-17T16:16:58.917Z",
  "pubdate": "2026-08-17T16:16:58.917Z",
  "executiveSummary": "An unauthenticated arbitrary HTML injection and Cross-Site Scripting (XSS) vulnerability exists in the Discourse discussion platform prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.\nThe vulnerability arises from improper handling of the color_scheme_id and dark_scheme_id cookies, allowing attackers to inject malicious markup directly into color scheme tags without proper sanitization or output escaping.\nSuccessful exploitation enables unauthenticated remote attackers to bypass Discourse's nonce-based Content Security Policy (CSP), resulting in the execution of arbitrary JavaScript within the execution context of visiting users' browsers.\nThe primary risk implications include session hijacking, unauthorized actions performed on behalf of authenticated users, and defacement or compromise of the affected web application interface.\nExploitation requires no prior authentication or elevated privileges, needing only a single crafted HTTP request containing the malicious cookie to target vulnerable instances.",
  "technicalDetails": "The root cause of this vulnerability is the lack of proper context-aware output escaping and input validation on user-controlled HTTP cookie values, specifically color_scheme_id and dark_scheme_id.\nThe application reads the values supplied via these cookies and directly interpolates them into a color scheme tag within the generated HTML response.\nBecause the raw cookie value is rendered without adequate escaping, an attacker can supply characters that break out of the HTML attribute context.\nThis breakout capability allows the insertion of arbitrary HTML tags into the DOM of the Discourse page.\nCrucially, the injected markup is structured in a manner that successfully bypasses Discourse's nonce-based Content Security Policy (CSP), which is otherwise designed to mitigate inline script execution.\nThe attack flow proceeds as follows: First, an unauthenticated attacker crafts a malicious payload encapsulated within the color_scheme_id or dark_scheme_id cookie. Second, the attacker induces a victim to send a request to the vulnerable Discourse server with the crafted cookie, or leverages a scenario where the cookie can be set. Third, the server processes the request, reads the unsanitized cookie, and embeds the raw value directly into the color scheme tag in the HTML response. Fourth, when the victim's browser parses the response, the attribute context is broken, executing the injected HTML and arbitrary JavaScript payload.\nThe vulnerable component involves the server-side rendering logic handling the color scheme cookies.\nAffected software versions comprise Discourse prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.\nThe attack surface is exposed over the network, requiring zero authentication and zero privileges to initiate.\nThe post-exploitation impact includes arbitrary JavaScript execution in the browser of any visitor who processes the malicious response, leading to potential account takeover, data exfiltration, and full client-side application compromise."
}