An authenticated user with default trust-level posting privileges can embed a crafted HTML video placeholder that causes an attribute breakout, injecting a malicious event handler into the placeholder. When a victim clicks the video overlay, the handler runs arbitrary JavaScript in the viewer’s session, enabling the attacker to read page content and perform authenticated requests. This is an uncontrolled script execution flaw (CWE‑79) that can compromise confidentiality and integrity of a user’s session.

Discourse discussion platform versions released prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 are vulnerable. The issue occurs when users with default posting privileges record the problematic placeholder in a post. All standard Discourse installations using these releases are affected unless security hardening measures intervene.

The CVSS score of 8.7 indicates high severity. EPSS is not available, but the flaw is not listed in CISA KEV, suggesting it is not widely exploited yet. The likely attack path requires an authenticated attacker to publish the malformed placeholder and a victim to view and interact with the post; the vulnerability is local to the visitor’s browser. The CVE does not indicate a remote exploitation vector, so the threat is constrained to users who open the affected content.