Stored XSS in Discourse via Encoded Iframe src

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Discourse, an open-source discussion platform. It allows an attacker with posting privileges to embed a malicious iframe in a post that bypasses the allowed_iframes security policy. The issue occurs due to inconsistent validation between the decoded and encoded forms of the iframe src attribute, enabling the browser to render attacker-controlled cross-origin content.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your Discourse instance is running a vulnerable version (prior to 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0). Inspect posts for iframes with encoded userinfo in the src attribute that may bypass the allowed_iframes policy. Review server logs for suspicious iframe rendering behavior.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to inject malicious iframes into posts, potentially leading to phishing attacks, session hijacking, or unauthorized actions on behalf of users. Users viewing the compromised posts may unknowingly interact with malicious content, risking data theft or malware exposure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exposure, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using vulnerable Discourse versions may face compliance violations, legal liabilities, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update Discourse to versions 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0 or later to fix the issue.

Useful 0 Not Useful 0