# CVE-2017-20290: Discourse reflected cross-site scripting in email unsubscribe

Source: https://junglewise.ai/threats/cve-2017-20290-discourse-1-9-0-beta2-before-1-9-0-beta13-contains-a-reflected  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2017-20290 · Severity: medium · CVSS 6.1 · Published 2026-10-22

Discourse, a community discussion platform, contains a reflected cross-site scripting (XSS) vulnerability in its email unsubscribe page that allows unauthenticated attackers to inject malicious scripts. An attacker can craft a malicious link that, when clicked by a user, executes arbitrary JavaScript in the victim's browser, potentially stealing session cookies, credentials, or performing actions on behalf of the user.

Technologies: [Discourse](https://junglewise.ai/threats/technologies/discourse). Vendors: [Discourse](https://junglewise.ai/threats/vendors/discourse).

## Quick answers

**Is CVE-2017-20290 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-20290 being exploited in the wild.

**How severe is CVE-2017-20290?** Medium severity, with a CVSS score of 6.1, published 22 October 2026.

**Which products and versions are affected?** Discourse 1.9.0.beta2 to before 1.9.0.beta13.

**Is there a fix for CVE-2017-20290?** Yes: fixed in 1.9.0.beta13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-20290 attacked?** It is attacked over the network.

**Am I affected by CVE-2017-20290?** Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.9.0.beta13

## Technical details

A reflected XSS vulnerability exists in the /email/unsubscribed endpoint where the email parameter is rendered unescaped via html_safe in the unsubscribed.html.erb template. Unauthenticated attackers can inject SVG onload payloads through crafted GET requests. The vulnerability was fixed by adding validation to raise Discourse::NotFound if the email parameter does not correspond to a valid user.

## Affected products

- Discourse Discourse 1.9.0.beta2 to before 1.9.0.beta13

## Timeline

- 2026-10-22: disclosed
- 2023-10-19: exploited: Exploitation evidence observed by Shadowserver Foundation

## References

- [https://github.com/discourse/discourse/commit/6e37f09b19](https://github.com/discourse/discourse/commit/6e37f09b19)
- [https://github.com/discourse/discourse/commit/a6f2533d38](https://github.com/discourse/discourse/commit/a6f2533d38)

## Related threats

- [Discourse oEmbed HTML injection in iframe allowlist](https://junglewise.ai/threats/cve-2026-91159-discourse-is-an-open-source-discussion-platform-prior-to-2026-9-0)
- [Discourse insufficient upload security metadata reconciliation](https://junglewise.ai/threats/cve-2026-91157-discourse-is-an-open-source-discussion-platform-prior-to-2026-9-0)
- [Discourse HTML injection in chat message excerpts](https://junglewise.ai/threats/cve-2026-91121-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8)
- [Discourse HTML injection in lazy video embed notifications](https://junglewise.ai/threats/cve-2026-91120-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8)
- [Discourse stored HTML injection in activity log components](https://junglewise.ai/threats/cve-2026-91119-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8)