Is CVE-2026-72729 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-72729 being exploited in the wild.

How severe is CVE-2026-72729?

Informational severity, published 10 August 2026.

Which products and versions are affected?

Discourse prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Is there a fix for CVE-2026-72729?

A patch was published on 2026-07-28: Security commits for HTML injection prevention merged across multiple release branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-72729 attacked?

It is attacked over the network.

Am I affected by CVE-2026-72729?

Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-72729: Discourse discourse-local-dates HTML injection

CVE-2026-72729 · Severity: info · Published 2026-08-10

Discourse is an open-source community discussion platform used by organizations to host forums and conversations. The discourse-local-dates plugin, which formats and displays dates in users' local timezones, contains a vulnerability that allows malicious actors to inject arbitrary HTML into rendered pages when Content Security Policy is modified or disabled. This could enable attackers to deface pages, steal user session cookies, or redirect users to malicious sites.

Technologies: Discourse. Vendors: Discourse.

Quick answers

Is CVE-2026-72729 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-72729 being exploited in the wild.
How severe is CVE-2026-72729?: Informational severity, published 10 August 2026.
Which products and versions are affected?: Discourse prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Is there a fix for CVE-2026-72729?: A patch was published on 2026-07-28: Security commits for HTML injection prevention merged across multiple release branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-72729 attacked?: It is attacked over the network.
Am I affected by CVE-2026-72729?: Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The discourse-local-dates plugin renders user-supplied local-date format data directly as HTML via insertAdjacentHTML(), allowing HTML injection when CSP is weakened or disabled. The vulnerable code embeds unsanitized date formatting data into HTML string templates. An attacker can craft a malicious date format value in a post or message that, when rendered by other users on sites with non-default CSP, executes arbitrary JavaScript or injects HTML elements. The fix (committed 2026-07-28) replaces HTML string injection with DOM element creation methods (createElement and textContent), ensuring content is treated as text rather than markup. Patches are available in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Affected products

Discourse Discourse prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0

Timeline

2026-08-10: disclosed
2026-07-28: patched: Security commits for HTML injection prevention merged across multiple release branches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.