Description
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could create a post for an enabled YouTube, Vimeo, or TikTok provider whose title contained markup, and the email and chat-summary rendering path would place that markup into the output instead of treating it solely as text. Recipients using HTML-capable email clients could see injected content, potentially including event handlers, but the issue did not directly expose a Discourse browser session or affect the forum page itself. Lazy video embeds must be enabled, which is the default configuration. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Published: 2026-09-24
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored HTML injection via email and chat notifications
Action: Patch Now
AI Analysis

Impact

Discourse allows provider-controlled video titles to be re-parsed as HTML when generating notification emails or chat summaries. A user with normal posting rights can embed arbitrary markup, including event handlers, in the title of an enabled YouTube, Vimeo, or TikTok link. Recipients who view the resulting HTML-enabled email or chat summary may have that markup executed in their email client, potentially enabling malicious actions such as phishing or data exfiltration, but the vulnerability does not alter the forum page itself. The weakness is a stored cross-site scripting flaw (CWE‑79).

Affected Systems

The flaw affects all Discourse installations running versions prior to 2026.1.8, 2026.6.3, 2026.7.2 or 2026.8.0. Lazy video embeds, which are enabled by default, are required for the issue to manifest.

Risk and Exploitability

With a CVSS score of 5.4 the vulnerability is considered moderate. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is user-generated content sent to the forum; an attacker simply posts a video with a crafted title. If the victim opens the notification email or chat summary in an HTML-capable client that executes JavaScript, the injected content can run. Because the flaw is limited to email or chat rendering, the overall threat surface is narrower than a typical forum code-execution bug, but the risk remains significant for organizations relying on email notifications.

Generated by OpenCVE AI on September 25, 2026 at 06:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Discourse to any of the fixed releases 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0.
  • If an upgrade cannot be performed immediately, disable lazy video embeds in the configuration so titles are not re-parsed as HTML.
  • Ensure that your email clients are configured to block or sanitize JavaScript in HTML emails, and advise users to avoid clicking suspicious links in notifications.

Generated by OpenCVE AI on September 25, 2026 at 06:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 24 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Discourse
Discourse discourse
Vendors & Products Discourse
Discourse discourse
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could create a post for an enabled YouTube, Vimeo, or TikTok provider whose title contained markup, and the email and chat-summary rendering path would place that markup into the output instead of treating it solely as text. Recipients using HTML-capable email clients could see injected content, potentially including event handlers, but the issue did not directly expose a Discourse browser session or affect the forum page itself. Lazy video embeds must be enabled, which is the default configuration. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Title Discourse: Stored HTML injection in video notification emails
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Discourse Discourse
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-24T17:24:59.169Z

Reserved: 2026-09-14T19:36:48.843Z

Link: CVE-2026-91120

cve-icon Vulnrichment

Updated: 2026-09-24T17:24:55.323Z

cve-icon NVD

Status : Deferred

Published: 2026-09-24T18:19:06.397

Modified: 2026-09-24T18:19:06.540

Link: CVE-2026-91120

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T06:30:06Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')