MEDIUM 5.4 NVD
CVE-2026-59830
Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolatin
Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action descriptions. Viewing the affected user activity streams could execute attacker-controlled script in another user's browser. This issue is fixed in version 2026.7.0.
References
- https://github.com/discourse/discourse/commit/dd786594ddd088657a7e6f9fefba5bd889965fe4
- https://github.com/discourse/discourse/releases/tag/v2026.7.0
- https://github.com/discourse/discourse/security/advisories/GHSA-x6mf-p7cg-69rw
This medium severity vulnerability with a CVSS score of 5.4 was published on 2026-09-21 via NVD.
vulnfeed aggregates 14328 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.