Executive brief
Discourse is an open-source community discussion platform where users can post and interact. An attacker could craft a malicious display name that would inject JavaScript code into post action descriptions, allowing the attacker to steal session tokens, deface posts, or perform actions on behalf of any user viewing that user's activity stream.
Technical details
Stored XSS vulnerability in the post-action-description component where user-controlled display names are interpolated into HTML passed to trustHTML without proper escaping. An authenticated attacker can set a crafted display name containing HTML/JavaScript markup; when other users view the attacker's activity stream or post actions, the malicious script executes in their browser context. Fixed in version 2026.7.0.
Affected products
- Discourse Discourse before 2026.7.0
Timeline
- 2026-09-21: disclosed
- 2026-07-28: patched: fixed in version 2026.7.0