Discourse up to 2026.1.7/2026.6.2/2026.7.1 Chat Message Excerpt Renderer cross site scripting

Summaryinfo

A vulnerability identified as problematic has been detected in Discourse up to 2026.1.7/2026.6.2/2026.7.1. This impacts an unknown function of the component Chat Message Excerpt Renderer. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2026-91121. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Discourse up to 2026.1.7/2026.6.2/2026.7.1 and classified as problematic. This issue affects some unknown functionality of the component Chat Message Excerpt Renderer. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. Impacted is integrity. The summary by CVE is:

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was then interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. The issue allowed trusted-HTML injection that altered rendered excerpt content, but JavaScript execution was not demonstrated with default Content Security Policy settings. The advisory states that no confidentiality, integrity, or availability impact was identified, while its structured scoring metadata separately assigns low integrity impact. Sites that disable or relax the default CSP have increased exposure. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-91121 since 09/14/2026. The exploitation is known to be easy. The attack may be initiated remotely. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

Upgrading to version 2026.1.8, 2026.6.3, 2026.7.2 or 2026.8.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Chat Software

Name

• Discourse

Version

• 2026.1.0
• 2026.1.1
• 2026.1.2
• 2026.1.3
• 2026.1.4
• 2026.1.5
• 2026.1.6
• 2026.1.7
• 2026.6.0
• 2026.6.1
• 2026.6.2
• 2026.7.0
• 2026.7.1

License

• open-source

Website

• Product: https://github.com/discourse/discourse/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion