The vulnerability is a classic CWE-79 (Cross‑Site Scripting) flaw in the Discourse platform's URL construction for user mentions. The system embeds the action_code_who value directly into the href attribute of a mention link without URL encoding. The visible mention text is escaped, but because the path component is unencoded, an attacker can provide a quote-bearing display name that terminates the URL. This allows the injection of attacker-controlled HTML or script fragments into the trusted rendered markup presented to other users. The stored injection can trigger arbitrary client-side code when any user views the affected topic action or activity log.

Discourse, the open‑source discussion platform, is affected. Versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 contain the vulnerability. The fix is included in those four releases and later versions.

The CVSS score of 6.4 indicates a moderate severity. An attacker can exploit the flaw by creating or altering a user display name that contains a quote character to terminate the URL attribute. Because the injected content is stored in the activity log or topic action, the malicious markup will be served to every user who views the post, enabling cross‑site scripting attacks. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, implying there is no publicly known exploit yet but the potential remains high for systems exposed to untrusted users who can create forum accounts or posts. Due to the stored nature of the injection, protection against this attack requires remediation rather than defenses at runtime.