Discourse 1.9.0.beta2 through 1.9.0.beta12 includes a reflected cross‑site scripting flaw that allows any unauthenticated user to inject and execute arbitrary JavaScript when a victim visits /email/unsubscribed. Attackers can craft GET requests containing SVG elements with onload handlers; the application renders the email query parameter with html_safe, causing the payload to be executed in the victim’s browser. The impact is principal code execution in the user’s browser, enabling session hijacking, credential theft, or defacement of the site to the extent client‑side trust.

This vulnerability affects all Discourse installations running any version prior to 1.9.0.beta13. The issue is present in the main Discourse repository from the first beta release through beta12. Administrators should confirm that their platform is running 1.9.0.beta13 or later. The affected product is the public Forum software named Discourse; any deployment that has not applied the commit changes referenced in the advisory is vulnerable.

The CVSS base score of 5.1 indicates moderate severity. No EPSS data is currently released, and the vulnerability is not listed in the CISA KEV catalog, hinting at a lower likelihood of mass exploitation. Inferred attack vector is "Network" because a crafted HTTP request can be sent from anywhere on the Internet; authentication is not required. An attacker who succeeds can enforce malicious script execution only within victim browsers visiting the unsubscribed page. The threat is therefore mainly to end‑users who view that page, although the presence of a vulnerable endpoint may degrade overall site trustworthiness.