CVE-2026-72720 in Discourse
Summary
by MITRE • 08/10/2026
Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.format_for_email because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag data-slug values can cause decoded attribute text to be reinterpreted as HTML. The vulnerable conversion also fails to strictly validate the Vimeo iframe host and path, allowing non-Vimeo allowlisted iframes to be converted. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The Discourse platform vulnerability involves a critical HTML injection flaw within the PrettyText.format_for_email function that affects multiple versions prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1. This vulnerability stems from improper handling of attribute values during email formatting operations where the cooked attribute values are reparsed as markup without adequate sanitization. The flaw creates a pathway for attackers to inject malicious HTML content through carefully crafted inputs that get processed and converted into email representations. The vulnerability specifically targets three distinct input vectors including Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag data-slug values where the decoded attribute text gets reinterpreted as HTML markup rather than being properly escaped or validated.
The technical implementation of this vulnerability occurs when Discourse processes user-generated content for email delivery by reparsing already processed cooked attributes as additional markup. This creates a double-processing scenario where malicious payloads embedded in legitimate-looking attributes can be executed when the system attempts to convert these values back into HTML format. The vulnerability extends beyond simple attribute injection to include path validation failures in Vimeo iframe handling, allowing attackers to bypass host restrictions and inject iframes from non-allowlisted domains. This weakness enables attackers to embed malicious content that could include tracking pixels, phishing links, or other harmful elements within the email notifications sent by the platform.
The operational impact of this vulnerability is significant as it allows remote code execution capabilities through email delivery mechanisms, potentially enabling attackers to compromise user accounts, conduct phishing campaigns, or extract sensitive information from the Discourse community. The vulnerability affects all users who receive emails generated by the platform, making it a widespread concern that could be exploited at scale. Attackers can leverage this flaw to inject malicious content into email communications, potentially leading to credential theft, data exfiltration, or further exploitation of other system components. The issue particularly affects organizations relying on Discourse for community management, forums, and discussion platforms where email notifications are frequently used.
Security mitigations for this vulnerability involve upgrading to the patched versions 2026.1.7, 2026.6.2, 2026.7.1, or 2026.8.0-latest.1 which implement proper input validation and sanitization of attribute values during the PrettyText.format_for_email processing. Organizations should also implement strict content filtering mechanisms that validate all iframe sources against approved domains and enforce stricter attribute validation for all user-submitted content. The fix addresses the core issue by ensuring that attribute values are properly escaped or validated before being reparsed as markup, preventing the re-execution of malicious content. Additionally, implementing proper input validation frameworks aligned with CWE-79 (Cross-site Scripting) and following ATT&CK technique T1566.001 (Phishing) mitigation strategies would further strengthen the platform's defenses against similar injection attacks.
This vulnerability demonstrates the importance of proper input sanitization in web applications, particularly when processing content for different output formats such as email generation. The issue highlights how seemingly benign attribute handling can create security risks when not properly validated and sanitized. The fix addresses fundamental security principles outlined in OWASP Top 10 and NIST cybersecurity frameworks, specifically targeting the prevention of code injection attacks that could compromise user privacy and system integrity. Organizations should conduct regular security assessments to identify similar vulnerabilities in their web applications and ensure proper input validation across all processing pipelines to prevent cascading security issues.
The vulnerability classification aligns with CWE-79 (Cross-site Scripting) and CWE-116 (Improper Encoding or Escaping of Output) which govern the proper handling of user-provided data in web applications. This weakness also relates to ATT&CK technique T1566.001 (Phishing) as it enables attackers to create malicious email content that could be used for social engineering attacks. The remediation approach taken by Discourse developers demonstrates proper secure coding practices including input validation, output encoding, and proper attribute handling that should serve as a reference implementation for similar vulnerabilities in other platforms. Organizations should establish security protocols that include regular version updates, vulnerability assessments, and proper input sanitization procedures to prevent exploitation of similar injection flaws.
The specific technical flaw in Discourse's email processing pipeline represents a classic case of insufficient data validation where user-provided attributes are not properly escaped or validated before being processed through multiple parsing stages. This creates an environment where attackers can craft malicious payloads that survive initial validation but are then executed during subsequent processing steps. The vulnerability is particularly concerning because it operates at the email generation level, meaning that even legitimate users could unknowingly receive emails containing malicious content that gets injected through the platform's attribute handling mechanisms. The patched versions implement comprehensive input validation that prevents the reprocessing of potentially dangerous content while maintaining the platform's core functionality for legitimate user interactions.
Implementation of proper security controls around this vulnerability requires organizations to understand the attack surface presented by multi-stage content processing systems and ensure that each stage properly validates and sanitizes inputs. The fix demonstrates the importance of defense-in-depth approaches where multiple layers of validation work together to prevent exploitation attempts. Security teams should monitor for similar vulnerabilities in other platforms and components that handle user-generated content, particularly those that process data through multiple transformation stages. The vulnerability serves as a reminder that even well-established open-source platforms can contain security weaknesses that require continuous monitoring and updating to maintain secure operations.