Executive brief
Discourse is an open-source discussion platform used to host community forums and discussions. A vulnerability in its email formatting system allows attackers to inject arbitrary HTML code through specially crafted content, potentially enabling phishing attacks, account compromise, or malware distribution via email notifications sent to users.
Technical details
The vulnerability is an HTML injection flaw in the PrettyText.format_for_email method, which processes HTML attributes for email formatting. The root cause is improper rehandling of already-cooked (processed) attribute values, where attributes containing special characters are reparsed as HTML markup instead of being treated as plain text. Attackers can craft malicious Vimeo iframe sources, secure-upload URLs with specific dimension values, or hashtag data-slug attributes that, when decoded, become interpreted as HTML tags. The vulnerable code also fails to strictly validate Vimeo iframe hosts and paths, allowing non-allowlisted iframes to be processed. No authentication is required—any user who can create or edit forum content can exploit this. Patches are available in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1 and later.
Affected products
- Discourse Discourse Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1
Timeline
- 2026-08-10: disclosed