CVE-2026-91121 in Discourse
Summary
by MITRE • 09/24/2026
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was then interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. The issue allowed trusted-HTML injection that altered rendered excerpt content, but JavaScript execution was not demonstrated with default Content Security Policy settings. The advisory states that no confidentiality, integrity, or availability impact was identified, while its structured scoring metadata separately assigns low integrity impact. Sites that disable or relax the default CSP have increased exposure. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in Discourse prior to the specified patch versions represents a classic case of unescaped HTML rendering within user-controlled input fields, specifically targeting file upload filenames used as metadata for chat message excerpts. In modern web applications, particularly those handling rich text and dynamic content like discussion forums, proper sanitization is critical to prevent malicious actors from injecting arbitrary markup into rendered views. The core technical flaw lies in the application's failure to escape special HTML characters within filename strings before they are processed by various frontend components responsible for displaying chat summaries. When a user uploads a file with a specially crafted name containing HTML tags or attributes, these elements are not neutralized and instead pass through the rendering pipeline intact. This allows the browser to interpret the injected markup as part of the page structure rather than plain text data.
The operational impact manifests across multiple interface components where chat excerpts are displayed, including channel lists, summary emails, pinned message bars, reply previews, and thread previews. Because these areas rely on dynamic content injection based on user activity, an attacker can manipulate the visual presentation of the application by injecting HTML that alters layout, overlays existing elements, or creates deceptive UI states. This type of attack falls under the category of Cross-Site Scripting (XSS), specifically categorized as CWE-79: Improper Neutralization of Input During Web Page Generation. While traditional XSS often focuses on script execution for session hijacking or data theft, this specific instance is characterized by trusted HTML injection that primarily affects integrity and presentation rather than direct code execution under default configurations.
Security assessments indicate that the vulnerability does not result in a breach of confidentiality, integrity regarding stored data, or availability of services when standard security controls are active. The primary risk vector is tied to Content Security Policy (CSP) settings. Under default CSP configurations, which typically restrict inline script execution and limit external resource loading, the injected HTML cannot execute JavaScript payloads. Consequently, an attacker cannot directly steal session cookies, perform actions on behalf of users, or exfiltrate sensitive data through this specific flaw alone. However, if a site administrator has disabled or relaxed the default CSP to allow certain types of dynamic content or inline scripts for other legitimate purposes, the attack surface expands significantly. In such environments, the injected HTML could potentially serve as a vector for more severe attacks, including stored XSS that leads to account compromise or phishing via manipulated UI elements.
The structured scoring metadata assigns a low integrity impact because while the visual representation of the application can be altered, there is no mechanism demonstrated here for modifying server-side data or persisting malicious scripts in a way that affects other users beyond the immediate rendering context. The vulnerability is classified under MITRE ATT&CK technique T1059: Command and Scripting Interpreter if CSPs are weak, but more accurately aligns with UI redressing or content injection tactics when considering the limited scope of impact. It highlights the importance of consistent input validation across all user-facing inputs, including metadata fields like filenames that may be repurposed for display in sensitive contexts such as email notifications and chat interfaces.
Mitigation strategies focus primarily on upgrading to patched versions where this sanitization logic has been corrected. Administrators must ensure they are running Discourse version 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0 or later. Beyond patching, organizations should audit their CSP configurations to ensure that no unnecessary relaxations are in place that could exacerbate similar vulnerabilities. Implementing strict Content Security Policies remains a critical defense-in-depth measure, ensuring that even if input sanitization fails, the browser will block any attempt to execute malicious scripts derived from injected content. Regular security audits and penetration testing should include checks for HTML injection in metadata fields to prevent such presentation-layer attacks.