CVE-2026-91119
Deferred Deferred - Pending Action

Stored XSS in Discourse via Unencoded Action Code

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form action_code_who value into mention-link href attributes without URL encoding. A quote-bearing display name could terminate the intended URL attribute and inject attacker-controlled elements into the trusted rendered markup. Although the visible mention text was escaped, the unencoded path component allowed stored HTML injection when another user viewed the affected topic action or activity log. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-91119
EUVD
EUVD-2026-86307

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
discourse discourse 2026.1.8
discourse discourse 2026.6.3
discourse discourse 2026.7.2
discourse discourse 2026.8.0
discourse discourse to 2026.1.8 (exc)
discourse discourse to 2026.6.3 (exc)
discourse discourse to 2026.7.2 (exc)
discourse discourse to 2026.8.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Discourse allows an attacker to inject malicious HTML into URLs by exploiting unencoded user-controlled input in the action_code_who field. The affected components (topic small-action and nested-activity-log) failed to properly encode URLs, enabling stored HTML injection when users viewed topics or activity logs.

Impact Analysis

An attacker could craft malicious links that appear legitimate but execute unintended actions when clicked. This could lead to phishing attacks, session hijacking, or defacement of Discourse pages. Users viewing compromised topics or logs may unknowingly load attacker-controlled content.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized data access or modification through injected scripts. For HIPAA, it may compromise protected health information if attacker-controlled content exfiltrates data. Organizations must patch to maintain compliance.

Mitigation Strategies

Update Discourse to a fixed version (2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0 or later) to address the stored HTML injection vulnerability in the topic small-action and nested-activity-log components.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91119. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart