Stored HTML injection in Discourse oEmbed via allowed iframe
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Discourse before 2026.1.9, and releases before 2026.7.3 or 2026.8.1 in their respective lines, treat an entire oEmbed HTML fragment as trusted when it contains an allowlisted iframe, which enables improper neutralization of input (CWE-79). A user with posting permission who controls a public webpage and its oEmbed response can add unrelated HTML or CSS to post content, such as visual overlays that make misleading or fraudulent interfaces appear. Exploitation requires a posting account and an allowlisted iframe source. The flaw affects content integrity only.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permission who controlled a public webpage and its oEmbed response could combine an allowlisted iframe with unrelated sibling HTML or CSS, causing stored visual overlays or other styled content to appear in post content and enabling misleading or fraudulent user interfaces. Exploitation requires a posting account, control of the fetched webpage and oEmbed response, and an allowlisted iframe source. The issue affects content integrity but does not expose restricted data, disrupt availability, or require interaction with Discourse Content Security Policy. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| discourse | discourse | before 2026.1.9; 2026.7.0-latest to before 2026.7.3; 2026.8.0-latest to before 2026.8.1; 2026.9.0-latest to before 2026.9.0 | 2026.1.9, 2026.7.3, 2026.8.1, 2026.9.0 | Patch available | CNA |
- discourse Vendordiscourse Affected before 2026.1.9; 2026.7.0-latest to before 2026.7.3; 2026.8.0-latest to before 2026.8.1; 2026.9.0-latest to before 2026.9.0 Fixed in 2026.1.9, 2026.7.3, 2026.8.1, 2026.9.0 Patch available CNA
Remediation
Update Discourse to version 2026.1.9, 2026.7.3, 2026.8.1, or 2026.9.0, depending on the release line in use.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA discourse (discourse) Fixed in 2026.1.9, 2026.7.3, 2026.8.1, 2026.9.0
Timeline
- 2026-10-14 Threatist record created from CVE-2026-91159
- 2026-10-16 Priority changed: MEDIUM → LOW
- 2026-10-20 CISA SSVC decision points changed
References
Other 5
- https://github.com/discourse/discourse/security/advisories/GHSA-f9jx-vv33-4282
- https://github.com/discourse/discourse/commit/0953b31f5c2949d7d6ab5f6dc4c5e2f1b8bf0b22
- https://github.com/discourse/discourse/commit/3fc2bad6cdca47b00958330d1ee612aa141b039a
- https://github.com/discourse/discourse/commit/dde8bc4fb6200139f5eff7e100b0f3e829d37ab3
- https://github.com/discourse/discourse/commit/ed6f83f123d1a4c6c6c7e64c8a2233e3cb6a28d7
More discourse vulnerabilities
- TI-2022-22806 Discourse BBCode plugin vulnerable to arbitrary CSS injection CVSS 3.1CRITICAL 9.8
- TI-2021-19656 Denial of Service in discourse CVSS 3.1MEDIUM 6.8
- TI-2024-36150 Potential Backup file leaked via Nginx in Discourse CVSS 3.1HIGH 7.5
- TI-2021-18002 RCE via malicious SNS subscription payload CVSS 3.1CRITICAL 10.0
- TI-2026-24651 Discourse: Open redirect via `sso_destination_url` cookie in `enter` CVSS 4.0MEDIUM 5.1
- TI-2022-18730 Discourse Patreon vulnerable to improper validation of email during Patreon authentication CVSS 3.1CRITICAL 9.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences