CVE-2026-72729 in Discourse
Summary
by MITRE • 08/10/2026
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse-local-dates plugin rendered crafted local-date format data as HTML on sites with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/10/2026
The discourse-local-dates plugin vulnerability represents a critical cross-site scripting risk that emerged in Discourse discussion platforms prior to specific version releases. This security flaw exploited the plugin's handling of user-supplied date format data, creating an avenue for malicious actors to inject arbitrary HTML content into the platform's rendering pipeline. The vulnerability specifically manifested when sites operated with modified or disabled default Content Security Policy configurations, which removed critical protections against unauthorized script execution. The issue stems from inadequate input sanitization and improper HTML escaping mechanisms within the plugin's date formatting functionality, allowing crafted local-date format strings to bypass security controls and execute malicious code in users' browsers.
The technical exploitation of this vulnerability aligns with common CWE classifications related to improper input validation and cross-site scripting vulnerabilities. Specifically, this issue maps to CWE-79 which describes improper neutralization of input during web page generation, and CWE-116 which addresses improper encoding or escaping of output data. The vulnerability operates through a classic XSS attack vector where malicious date format strings containing HTML tags or JavaScript code are processed by the plugin and subsequently rendered as part of the webpage content. When combined with sites that lack proper CSP enforcement, attackers could execute arbitrary scripts within the context of authenticated user sessions, potentially leading to account takeovers, data exfiltration, or further privilege escalation attacks.
The operational impact of this vulnerability extends beyond simple script execution, as it represents a significant threat to platform integrity and user security. Attackers could leverage this flaw to inject malicious payloads that persist across user sessions, enabling long-term surveillance or manipulation of platform content. The vulnerability's potential for abuse increases substantially in environments where users have elevated privileges or where the platform serves as a critical communication channel for sensitive discussions. Organizations relying on Discourse for collaborative workspaces, community forums, or enterprise communication systems face particular risk, as compromised sessions could lead to unauthorized access to confidential information or disruption of critical discussion threads.
Mitigation strategies for this vulnerability encompass both immediate remediation and long-term security hardening measures. The primary solution involves upgrading to the patched versions 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0, which implement proper input validation and output sanitization for date format strings. Security teams should also enforce strict Content Security Policy configurations that prevent script execution from untrusted sources, even when the default policy has been modified. Additional protective measures include implementing proper input filtering at multiple layers of the application stack, conducting regular security audits of third-party plugins, and establishing monitoring for anomalous date formatting patterns in user-generated content. Organizations should also consider implementing web application firewalls to detect and block suspicious date format parameters before they reach the vulnerable plugin components.
The vulnerability demonstrates how seemingly innocuous plugin functionality can create significant security risks when proper input validation is absent from critical processing paths. This case highlights the importance of maintaining comprehensive security practices even in open-source environments where code review may be distributed across multiple contributors. The incident underscores ATT&CK framework concepts related to initial access through web application attacks and privilege escalation via session hijacking, particularly emphasizing how insecure data handling can serve as a foundation for more sophisticated exploitation techniques. Organizations must maintain vigilance against such vulnerabilities by implementing regular security updates, conducting thorough penetration testing of custom configurations, and establishing clear procedures for evaluating third-party component security before deployment in production environments.