Discourse up to 2026.6.2 Post Action escape output

Summaryinfo

A vulnerability was found in Discourse and classified as critical. This affects an unknown part of the component Post Action Component. The manipulation results in escape output. This vulnerability is known as CVE-2026-59830. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Discourse. It has been classified as critical. Affected is an unknown code of the component Post Action Component. The manipulation with an unknown input leads to a escape output vulnerability. CWE is classifying the issue as CWE-116. The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action descriptions. Viewing the affected user activity streams could execute attacker-controlled script in another user's browser. This issue is fixed in version 2026.7.0.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-59830 since 07/07/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading to version 2026.7.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Chat Software

Name

• Discourse

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.9
• 1.0.1
• 2.1.0.beta1
• 2.3.2
• 2.4.0.beta2
• 2.6
• 2.7.5
• 2.7.6
• 2.7.7
• 2.7.8
• 2.7.11
• 2.7.12
• 2.7.13
• 2.8.0.beta2
• 2.8.0.beta3
• 2.8.0.beta4
• 2.8.0.beta5
• 2.8.0.beta6
• 2.8.0.beta9
• 2.8.0.beta10
• 2.8.0.beta11
• 2.8.1
• 2.8.3
• 2.8.4
• 2.8.9
• 2.8.12
• 2.8.13
• 2.8.14
• 2.9.0.beta.12
• 2.9.0.beta.13
• 2.9.0.beta1
• 2.9.0.beta2
• 2.9.0.beta3
• 2.9.0.beta4
• 2.9.0.beta5
• 2.9.0.beta9
• 2.9.0.beta10
• 2.9.0.beta11
• 2.9.0.beta13
• 2.9.0.beta14
• 2.9.0.beta15
• 2.9.0.beta16
• 3.0
• 3.0.0.beta14
• 3.0.0.beta15
• 3.0.0.beta16
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.6
• 3.1.0.beta1
• 3.1.0.beta2
• 3.1.0.beta3
• 3.1.0.beta4
• 3.1.0.beta5
• 3.1.0.beta6
• 3.1.0.beta7
• 3.1.1
• 3.1.3
• 3.1.4
• 3.1.5
• 3.2.0.beta1
• 3.2.0.beta2
• 3.2.0.beta3
• 3.2.0.beta4
• 3.2.0.beta5
• 3.2.2
• 3.2.3
• 3.2.5
• 3.3.0.beta1
• 3.3.0.beta2
• 3.3.0.beta3
• 3.3.0.beta3-dev
• 3.3.0.beta4
• 3.3.0.beta4-dev
• 3.3.0.beta5
• 3.3.1
• 3.3.2
• 3.3.4
• 3.3.7
• 3.4.0.beta0
• 3.4.0.beta1
• 3.4.0.beta2
• 3.4.0.beta4
• 3.4.0.beta5
• 3.4.3
• 3.4.4
• 3.4.6
• 3.4.7
• 3.5.0.beta.7
• 3.5.0.beta.8
• 3.5.0.beta2
• 3.5.0.beta3
• 3.5.0.beta4
• 3.5.0.beta5
• 3.5.0.beta5-dev
• 3.5.0.beta6
• 3.5.0.beta6-dev
• 3.5.0.beta7-dev
• 3.5.0.beta8
• 3.5.0.beta8-dev
• 3.5.1
• 3.5.3
• 3.5.4
• 3.6.0.beta2
• 3.6.1
• 3.6.2
• 2025.11.1
• 2025.11.2
• 2025.12.0
• 2025.12.1
• 2025.12.2
• 2026.1.0
• 2026.1.1
• 2026.1.2
• 2026.1.3
• 2026.1.4
• 2026.1.5
• 2026.1.6
• 2026.1.7
• 2026.2.0
• 2026.2.1
• 2026.2.2
• 2026.3.0
• 2026.3.0-latest
• 2026.3.0-latest.1
• 2026.3.1
• 2026.4.0
• 2026.4.1
• 2026.4.2
• 2026.5.0
• 2026.5.0-latest.1
• 2026.5.1
• 2026.5.2
• 2026.6.0
• 2026.6.1
• 2026.6.2

License

• open-source

Website

• Product: https://github.com/discourse/discourse/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion