CVE-2026-72720
Received Received - Intake

HTML Injection in Discourse via PrettyText.format_for_email

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description
Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.format_for_email because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag data-slug values can cause decoded attribute text to be reinterpreted as HTML. The vulnerable conversion also fails to strictly validate the Vimeo iframe host and path, allowing non-Vimeo allowlisted iframes to be converted. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-72720
EUVD
EUVD-2026-55656

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
discourse discourse to 2026.1.7 (exc)
discourse discourse to 2026.6.2 (exc)
discourse discourse to 2026.7.1 (exc)
discourse discourse to 2026.8.0-latest.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Discourse allows HTML injection in the PrettyText.format_for_email function. It occurs because cooked attribute values are reparsed as markup, enabling crafted inputs like Vimeo iframe sources or hashtag data-slug values to be reinterpreted as HTML. This bypasses intended security checks.

Detection Guidance

This vulnerability involves HTML injection in Discourse's PrettyText.format_for_email function. Detection requires checking Discourse versions and inspecting HTML content for malformed iframe attributes or unexpected markup. No direct network commands exist; instead, verify Discourse version and review email or post content for injected HTML fragments.

Impact Analysis

An attacker could exploit this to inject malicious HTML or scripts into emails or other outputs, potentially leading to phishing attacks, data theft, or unauthorized actions on behalf of users. It may also allow non-Vimeo iframes to be rendered if the host/path validation is bypassed.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Non-compliance risks include fines or legal penalties.

Mitigation Strategies

Upgrade Discourse to versions 2026.1.7, 2026.6.2, 2026.7.1, or 2026.8.0-latest.1 or later. If immediate upgrade is not possible, restrict access to untrusted users and monitor for suspicious iframe or HTML content in posts and emails until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72720. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart