CVE-2026-59830

Received Received - Intake

Stored XSS in Discourse Post Action Component via Crafted Display Names

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description

Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action descriptions. Viewing the affected user activity streams could execute attacker-controlled script in another user's browser. This issue is fixed in version 2026.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-59830

Affected Vendors & Products

Vendor	Product	Version / Range
discourse	discourse	2026.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability in Discourse, prior to version 2026.7.0, involves improper escaping of user-controlled display names. Attackers could craft malicious display names containing HTML markup, which would be inserted into HTML strings without proper sanitization. When other users view activity streams, the attacker's script could execute in their browsers.

Detection Guidance

This vulnerability can be detected by checking if your Discourse instance is running a version prior to 2026.7.0. Use the command 'cd /var/discourse && ./launcher version' to check the installed version. If the version is below 2026.7.0, the system is vulnerable.

Impact Analysis

If you use a vulnerable Discourse version, an attacker could trick you into executing malicious scripts in your browser by viewing activity streams. This could lead to session hijacking, data theft, or unauthorized actions on your behalf. The impact is limited to users who view affected content.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance violations if user data is compromised through this exploit.

Mitigation Strategies

Immediately update Discourse to version 2026.7.0 or later. Follow the official Discourse upgrade guide to apply the patch. Ensure no user has a crafted display name that could exploit this issue before updating.

Hi! I’m here to help you understand CVE-2026-59830. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70