CVE-2026-91122
Deferred Deferred - Pending Action

Cross-Site Scripting in Discourse Video Placeholder

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting privileges could store the crafted placeholder in a post. When another user opened the post and clicked the video play overlay, the handler could execute arbitrary JavaScript in the viewer's session. Default Content Security Policy settings block inline event handlers, but instances with CSP disabled or relaxed could allow the script to read page content and make authenticated requests as the viewer. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-91122
EUVD
EUVD-2026-86302

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
discourse discourse 2026.1.8
discourse discourse 2026.6.3
discourse discourse 2026.7.2
discourse discourse 2026.8.0
discourse discourse to 2026.1.8 (exc)
discourse discourse to 2026.6.3 (exc)
discourse discourse to 2026.7.2 (exc)
discourse discourse to 2026.8.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Discourse, a discussion platform, involves a flaw in the video placeholder component. Before versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, crafted HTML could break out of attributes and inject an event handler. An authenticated user with basic privileges could store this in a post. When another user clicked the video play overlay, the event handler could execute arbitrary JavaScript in their session.

Impact Analysis

An attacker could execute arbitrary JavaScript in your session when you view a crafted post. This could allow them to read page content or make authenticated requests on your behalf. The impact depends on your Discourse instance's Content Security Policy (CSP) settings. If CSP is disabled or relaxed, the risk is higher.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, potentially violating GDPR's data protection requirements or HIPAA's privacy rules. If exploited, it may result in data breaches, unauthorized data access, or session hijacking, all of which are compliance violations.

Mitigation Strategies

Update Discourse to version 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0 or later to patch the vulnerability. If updating is not immediately possible, disable the video placeholder feature or ensure Content Security Policy (CSP) is enabled and properly configured to block inline event handlers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91122. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart