CVE-2026-91121
Deferred Deferred - Pending Action

Cross-Site Scripting in Discourse via Chat Filename

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was then interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. The issue allowed trusted-HTML injection that altered rendered excerpt content, but JavaScript execution was not demonstrated with default Content Security Policy settings. The advisory states that no confidentiality, integrity, or availability impact was identified, while its structured scoring metadata separately assigns low integrity impact. Sites that disable or relax the default CSP have increased exposure. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-10-15
AI Q&A
2026-09-24
EPSS Evaluated
2026-10-13
NVD
CVE-2026-91121
EUVD
EUVD-2026-86306

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
discourse discourse 2026.1.8
discourse discourse 2026.6.3
discourse discourse 2026.7.2
discourse discourse 2026.8.0
discourse discourse to 2026.1.8 (exc)
discourse discourse to 2026.6.3 (exc)
discourse discourse to 2026.7.2 (exc)
discourse discourse to 2026.8.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Discourse versions before 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 involves improper escaping of attacker-controlled upload filenames in chat message excerpts. This allowed HTML injection in interface elements like chat channel lists, emails, and previews, though JavaScript execution was not demonstrated under default security settings.

Detection Guidance

This vulnerability involves improperly escaped HTML in chat message excerpts due to attacker-controlled filenames. To detect it, inspect Discourse logs for unusual filenames in chat messages or excerpts. Check if filenames contain HTML tags or scripts in chat channel lists, emails, or previews. No specific commands are provided in the context.

Impact Analysis

An attacker could trick users into viewing malicious filenames that alter rendered content in chat interfaces, emails, or previews. While no JavaScript execution was confirmed with default settings, sites with relaxed Content Security Policy (CSP) face higher risk of script execution.

Compliance Impact

The vulnerability could potentially affect compliance with GDPR and HIPAA by allowing HTML injection in user interfaces where chat message excerpts are displayed. This may lead to unauthorized data exposure or manipulation if attackers inject malicious content, though no confirmed confidentiality, integrity, or availability impact was identified under default settings.

Mitigation Strategies

Update Discourse to a patched version (2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0 or later). If updating is not possible, review and enforce the default Content Security Policy (CSP) to prevent HTML injection. Monitor chat message excerpts for suspicious filenames.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91121. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart