HTML Injection Vulnerability in Discourse Video Placeholder Component
CVE-2026-91122

8.7HIGH

Key Information:

Vendor

Discourse
Status
Discourse
Vendor
CVE Published:
24 September 2026

What is CVE-2026-91122?

The vulnerability found in the Discourse video placeholder component allows an authenticated user with default trust-level posting privileges to store a crafted HTML placeholder in a post. When another user views this post and interacts with the video play overlay, the crafted placeholder can execute arbitrary JavaScript within the viewer's session. While default Content Security Policy settings typically block inline event handlers, instances with relaxations or disabled CSP settings are particularly vulnerable, enabling attacks that may read sensitive page content or make unauthorized authenticated requests.

Affected Version(s)

discourse < 2026.8.0 < 2026.8.0

discourse >= 2026.7.0-latest, < 2026.7.2 < 2026.7.0-latest, 2026.7.2

discourse >= 2026.6.0-latest, < 2026.6.3 < 2026.6.0-latest, 2026.6.3

References

https://github.com/discourse/discourse/security/advisorie...
x_refsource_CONFIRM
https://github.com/discourse/discourse/pull/42882
x_refsource_MISC
https://github.com/discourse/discourse/commit/05d92b8749f...
x_refsource_MISC

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.