Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 allow an attacker to inject arbitrary HTML into a page by setting a specially crafted color_scheme_id or dark_scheme_id cookie. The cookie value is rendered inside a color scheme tag without escaping, enabling the attacker to break out of the attribute and insert a script tag that bypasses Discourse’s nonce‑based Content Security Policy, thereby executing arbitrary JavaScript in the browsers of any site visitor. This results in complete remote code execution on the client side and potential theft of sensitive information.

All installations of the open‑source Discourse discussion platform that are running a version earlier than 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 are at risk. The vulnerability directly affects the Discourse product distributed by the discourse vendor.

The CVSS score of 9.3 signals a critical severity, and the flaw can be triggered without authentication, making it highly accessible to attackers with network or phone proxy access to the site. Although no EPSS score is presently available, the lack of safeguards and the nature of the flaw suggest a high likelihood of exploitation in the wild. The vulnerability is not yet listed in the CISA KEV catalog, but its critical impact warrants immediate remediation.