Description

Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action descriptions. Viewing the affected user activity streams could execute attacker-controlled script in another user's browser. This issue is fixed in version 2026.7.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-21T22:16:57.353Z",
  "pubdate": "2026-09-21T22:16:57.353Z",
  "executiveSummary": "This vulnerability is a Stored Cross-Site Scripting (XSS) flaw identified within the Discourse post action component.\nThe issue arises from the improper sanitization of user-controlled display names, which are subsequently rendered as HTML.\nBy crafting a malicious display name containing arbitrary markup or scripts, an attacker can ensure the execution of unauthorized JavaScript within the browser sessions of other users who view the affected activity streams.\nThe vulnerability affects all versions of Discourse prior to 2026.7.0.\nSuccessful exploitation allows for the execution of attacker-controlled scripts in the context of the victim's session, potentially leading to unauthorized actions, session hijacking, or sensitive data theft.\nThis vulnerability is critical as it persists on the server and executes automatically whenever the malicious payload is rendered in the victim's browser, requiring no specific user interaction beyond navigating to the compromised activity feed.",
  "technicalDetails": "The root cause of this vulnerability is an input validation and output encoding failure within the post action component of the Discourse platform. Specifically, the application logic fails to apply necessary sanitization or character escaping to user-defined display names before incorporating them into an HTML string passed to the trustHTML function.\nThe trustHTML function is designed to handle content that is intended to be rendered as HTML; however, by failing to neutralize user-supplied input prior to this step, the application inadvertently treats malicious strings as trusted markup.\nThe exploitation flow begins when an attacker modifies their account's display name to include a crafted payload, such as a <script> tag or other HTML event handlers (e.g., onerror, onload) capable of executing JavaScript.\nOnce the display name is saved, the application persists this malicious string in the database. When other users navigate to an activity stream or profile view where the attacker's post action is listed, the server renders the HTML string containing the unescaped, malicious display name.\nUpon rendering, the victim's browser interprets the injected markup as legitimate document content and executes the payload. Because the script executes within the origin of the Discourse instance, the attacker inherits the victim's authentication context, enabling actions such as performing requests on behalf of the user, stealing session tokens, or exfiltrating private session data.\nThis vulnerability affects versions of Discourse prior to 2026.7.0. It requires the attacker to have the ability to set their own display name, which is a standard feature in Discourse, making the attack vector highly accessible. No additional administrative or high-level privileges are required to weaponize this injection, as the primary barrier is the ability to interact with the profile settings and have the resulting output consumed by other users' browser clients."
}