Description

Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-10T17:17:37.013Z",
  "pubdate": "2026-08-10T17:17:37.013Z",
  "executiveSummary": "An input validation vulnerability exists within the Onebox feature of the Discourse open-source discussion platform, specifically concerning allowlist enforcement. The vulnerability allows an authenticated user to craft and submit specially formed URLs that successfully bypass the intended Onebox domain and protocol restrictions. Consequently, an attacker can embed arbitrary malicious content directly into a vulnerable Discourse site.\nThe impact of successful exploitation includes the potential execution of unauthorized content within the context of the affected application, posing significant risks to user trust and site integrity through cross-site scripting or external content injection vectors. The affected systems encompass all Discourse deployments running versions prior to 2026.1.7.\nExploitation of this security flaw requires authenticated access to the platform, meaning an attacker must possess a valid user account to submit the malicious URLs. No specialized high-privilege administrative accounts are explicitly required, as standard authenticated users can trigger the URL processing mechanism. The risk implications highlight the necessity of robust URL parsing and strict allowlist validation routines to prevent security controls from being circumvented via obfuscated or malformed input structures.",
  "technicalDetails": "The root cause of this vulnerability lies in insufficient input sanitization and improper URL parsing logic within the Onebox component of Discourse. The Onebox feature is responsible for generating rich media previews and embedding external content based on submitted URLs. It relies on an allowlist mechanism designed to restrict embedded content strictly to trusted domains and protocols. However, the parser fails to adequately validate and normalize specially formed URLs, allowing malicious inputs to bypass the intended allowlist checks.\nThe vulnerable component is the Onebox URL validation and parsing module, affecting all versions of Discourse prior to 2026.1.7. Authentication and privilege requirements mandate that the attacker is an authenticated user of the platform. The network exposure is inherent to the web application interface where users are permitted to create posts or messages containing URLs.\nThe step-by-step attack flow proceeds as follows: First, the authenticated attacker crafts a specially formed URL designed to exploit flaws in the Onebox allowlist parsing logic, potentially utilizing obfuscation techniques, URL encoding anomalies, or redirection structures. Second, the attacker submits this URL within a post, comment, or message on the Discourse platform. Third, the Discourse server receives the input and processes it through the Onebox feature to generate an embedded preview. Fourth, because the URL bypasses the allowlist validation checks, the application treats the untrusted external source as valid. Fifth, the application fetches and embeds the malicious content associated with the crafted URL directly into the rendered page.\nThe payload behavior involves the unauthorized injection of external resources into the victim site's DOM or application context when other users view the affected content. The post-exploitation impact includes potential content spoofing, information disclosure via external resource loading, or secondary client-side attacks depending on the nature of the embedded malicious content rendered by the Onebox engine."
}