Description

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-10T17:17:37.507Z",
  "pubdate": "2026-08-10T17:17:37.507Z",
  "executiveSummary": "A stored cross-site scripting vulnerability has been identified in the Rich Text Editor of Discourse, an open-source discussion platform. The vulnerability exists due to improper rendering of a chat-transcript username as raw HTML. This security flaw enables authenticated users or external inputs capable of generating chat-transcripts to inject malicious scripts into the application context. When other users view the affected chat-transcript within the Rich Text Editor, the embedded malicious payload executes within the context of their active session, leading to potential session hijacking, unauthorized actions performed on behalf of the victim, or the extraction of sensitive data. The risk implication is significant as it compromises the integrity and confidentiality of user interactions within the platform. The vulnerability affects Discourse prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. Exploitation requires the ability to supply or manipulate a chat-transcript username that is subsequently processed and rendered by the Rich Text Editor without adequate sanitization or contextual output encoding.",
  "technicalDetails": "The vulnerability stems from insufficient output encoding and improper sanitization of user-supplied data within the Rich Text Editor component of Discourse. Specifically, the root cause is the insecure rendering of a chat-transcript username as raw HTML rather than safely encoded text strings. This processing flaw allows script tags or event handlers injected into the username field to be interpreted and executed by the victim's browser.\nThe attack flow begins when an attacker crafts a malicious payload containing executable JavaScript or HTML within a chat-transcript username. Upon submission, the application stores this unsanitized string in the backend database. When another user or administrator views the impacted chat-transcript via the Rich Text Editor, the vulnerable component retrieves the stored record and parses the username directly into the Document Object Model (DOM) without proper contextual output encoding.\nConsequently, the browser evaluates the injected payload as legitimate markup, executing the arbitrary JavaScript in the security context of the victim's session. Depending on the script's design, the payload can access Document.cookie, perform unauthorized asynchronous requests using the victim's credentials, manipulate the DOM to display phishing interfaces, or execute administrative functions if the victim possesses elevated privileges. The vulnerable component is isolated to the Rich Text Editor handling of chat-transcripts across Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}