CVE-2017-20290 in Discourse
Summary
by MITRE • 10/22/2026
Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb renders unescaped via html_safe, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
Discourse version 1.9.0.beta2 through versions prior to 1.9.0.beta13 is affected by a reflected cross-site scripting vulnerability located within the email unsubscription endpoint at /email/unsubscribed. This flaw stems from improper neutralization of user-supplied input before it is included in web content, specifically allowing attackers to inject malicious scripts via the email parameter. The vulnerability classifies under CWE-79 as Improper Neutralization of Input During Web Page Generation and aligns with MITRE ATT&CK technique T1059.007 for JavaScript execution within browser environments.
The technical root cause lies in how the application handles user input during the rendering process. When a victim accesses the unsubscription page, the server retrieves the email parameter from the request query string or body and passes it to the unsubscribed.html.erb template file. This template utilizes the html_safe method to render the content without escaping special characters such as angle brackets, quotes, or ampersands. Consequently, if an attacker crafts a GET request containing SVG elements with onload event handlers embedded in the email parameter, these scripts are injected directly into the HTML response and executed by the victim's browser upon page load.
Exploitation of this vulnerability requires no authentication, making it accessible to any unauthenticated actor on the internet. Attackers can distribute malicious links through phishing emails or other social engineering vectors that direct victims to the crafted URL. Upon clicking the link, the victim’s browser parses the injected SVG payload and executes the embedded JavaScript code within the context of the Discourse domain. This allows for session hijacking, credential theft via keyloggers, defacement of the user interface, or redirection to malicious sites designed to exploit other vulnerabilities in the client environment.
Evidence of active exploitation was first observed by the Shadowserver Foundation on October 19, 2023, indicating that this vulnerability is being targeted in real-world campaigns rather than remaining a theoretical risk. The presence of such attacks underscores the urgency for administrators to apply patches immediately. Mitigation involves upgrading Discourse to version 1.9.0.beta13 or later where the input sanitization logic has been corrected to properly escape user-supplied data before rendering it into HTML templates. Additionally, implementing Content Security Policy headers can provide an additional layer of defense by restricting script execution sources and mitigating the impact of successful injection attempts.