Description

Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.format_for_email because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag data-slug values can cause decoded attribute text to be reinterpreted as HTML. The vulnerable conversion also fails to strictly validate the Vimeo iframe host and path, allowing non-Vimeo allowlisted iframes to be converted. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-10T16:19:49.197Z",
  "pubdate": "2026-08-10T16:19:49.197Z",
  "executiveSummary": "An HTML injection vulnerability exists in Discourse prior to versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1 within the PrettyText.format_for_email component. The flaw arises because cooked attribute values are incorrectly reparsed as markup during email formatting. This enables attackers to inject arbitrary HTML content via crafted inputs such as Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag data-slug values. Furthermore, the conversion logic fails to strictly validate the Vimeo iframe host and path, permitting the insertion of non-allowlisted iframe sources. Successful exploitation allows an attacker to manipulate the rendered content of outbound emails, posing risks such as phishing, unauthorized content injection, and potential cross-site scripting or user deception depending on the email client's rendering behavior. The attack requires crafting specific input vectors processed by the formatting engine, but does not inherently require complex authentication or high privileges if the input can be introduced via standard platform interaction vectors.",
  "technicalDetails": "The vulnerability resides in the PrettyText.format_for_email function within Discourse, specifically in how the application handles previously cooked attribute values. The root cause is the improper handling of markup serialization where attribute values containing decoded text are subsequently reinterpreted and reparsed as HTML markup rather than being treated strictly as attribute data.\nAttackers can leverage multiple entry points to inject malicious payloads, including crafted Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag data-slug values. Because the decoding and parsing pipeline fails to sanitize or properly contextualize these attribute values, the raw text is expanded and executed or rendered as functional HTML tags and attributes in the resulting email output.\nIn addition to the attribute reparsing flaw, the vulnerable conversion mechanism exhibits insufficient validation logic regarding Vimeo iframe parameters. Specifically, it fails to strictly enforce the allowed host and path constraints for Vimeo iframes, allowing attackers to bypass allowlists and inject arbitrary, non-Vimeo iframe sources into the formatted email payload.\nThe attack flow proceeds as follows: First, an attacker injects a specially crafted payload into a platform vector (such as a hashtag data-slug, secure-upload parameter, or Vimeo iframe attribute). Second, the Discourse backend triggers PrettyText.format_for_email to prepare the content for outbound email distribution. Third, during this formatting process, the vulnerable component parses the cooked attributes, incorrectly treats the encoded or raw string data as raw markup, and fails to validate iframe source parameters. Finally, the resulting email contains the injected HTML structures, which are then delivered to recipients and rendered by vulnerable email clients.\nAffected versions include all Discourse installations prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1. The vulnerability exposes email recipients to manipulated content, facilitating potential phishing campaigns, content spoofing, and the integration of malicious external frames within organizational communications."
}