HTML Injection Vulnerability in Discourse Discussion Platform
CVE-2026-91121
What is CVE-2026-91121?
Prior to specific versions of Discourse, an HTML injection vulnerability existed due to unescaped HTML in filenames used within chat message excerpts. This issue allowed users who could upload files and send chat content to inject markup into filenames, which would then be rendered by various chat features including channel lists, summary emails, and reply previews. Although this vulnerability did not demonstrate JavaScript execution, it poses a risk, especially if a site's default Content Security Policy (CSP) is disabled or weakened. The issue has been addressed in subsequent versions, ensuring enhanced security.
Affected Version(s)
discourse < 2026.8.0 < 2026.8.0
discourse >= 2026.7.0-latest, < 2026.7.2 < 2026.7.0-latest, 2026.7.2
discourse >= 2026.6.0-latest, < 2026.6.3 < 2026.6.0-latest, 2026.6.3