Description

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback_message[message] is stored without sanitization and rendered in app/views/admin/feedback_messages/_feedback_message.html.erb through raw(feedback_message.message) when offender_id is present. Viewing the abuse report executes arbitrary JavaScript in an administrator's browser and may expose sensitive in-page data, abuse CSRF tokens, or perform administrative actions in the victim's session. The public FeedbackMessagesController accepts the report without authorization and previously permitted a submitted offender_id, making the vulnerable rendering path reachable by an unauthenticated attacker. This issue is fixed in commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-18T18:18:52.497Z",
  "pubdate": "2026-08-18T18:18:52.497Z",
  "executiveSummary": "A stored Cross-Site Scripting (XSS) vulnerability exists in Forem versions prior to commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c. The flaw allows an unauthenticated attacker to submit a malicious payload via the feedback_message[message] parameter, which is then stored in the database without proper sanitization. When an administrator views the corresponding abuse report, the payload is rendered via the raw helper in app/views/admin/feedback_messages/_feedback_message.html.erb. Successful exploitation leads to the execution of arbitrary JavaScript within the context of the administrator's browser session. This compromises confidentiality and integrity by exposing sensitive in-page data, enabling CSRF token theft, and allowing unauthorized administrative actions to be performed on behalf of the victim. The attack vector requires network connectivity to the public FeedbackMessagesController, which accepts submissions without authorization.",
  "technicalDetails": "The vulnerability resides in the feedback message handling and administrative rendering components of Forem. Specifically, the public FeedbackMessagesController accepts incoming feedback reports without requiring user authentication or authorization. Previously, the controller permitted the submission of an offender_id parameter alongside the feedback payload.\nThe root cause of the vulnerability is the lack of input sanitization combined with insecure output rendering. When a malicious value is supplied through the feedback_message[message] parameter and an offender_id is present, the application stores the input directly in the database. During administrative review, the stored message is retrieved and processed by the administrative view located at app/views/admin/feedback_messages/_feedback_message.html.erb.\nWithin this template, the application employs the raw(feedback_message.message) method. The raw helper explicitly bypasses Rails' built-in HTML-escaping mechanisms, causing the stored payload to be interpreted and executed directly by the browser as active markup rather than inert string data.\nThe attack flow proceeds as follows: 1) An unauthenticated attacker crafts a malicious JavaScript payload designed to interact with the DOM or execute unauthorized API requests. 2) The attacker sends an HTTP request to the public FeedbackMessagesController containing the payload in the feedback_message[message] parameter, along with a valid or simulated offender_id. 3) The application ingests and persists the unescaped payload in the database. 4) An unsuspecting administrator navigates to the admin panel to review abuse reports. 5) The application renders app/views/admin/feedback_messages/_feedback_message.html.erb, invoking the raw helper on the stored database record. 6) The browser executes the injected JavaScript script within the privileged administrative session.\nPost-exploitation impact includes the exposure of sensitive in-page data, the compromise of anti-CSRF tokens, and the capability to execute administrative functions silently. The affected versions include all Forem deployments prior to commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c."
}