Cross-Site Scripting Vulnerability in Discourse Open-Source Discussion Platform

CVE-2026-59830

What is CVE-2026-59830?

Discourse, a popular open-source discussion platform, suffers from a cross-site scripting vulnerability in its post action component. Before version 2026.7.0, the platform inadequately escaped user-controlled display names, allowing attackers to embed malicious markup within post action descriptions. This could lead to the execution of attacker-controlled scripts when the affected user activity streams are viewed in another user's browser. To mitigate this issue, users are encouraged to update to version 2026.7.0, where the vulnerability has been addressed.

References