Executive brief
Discourse is an open-source community discussion platform used by organizations to host forums and conversations. The discourse-local-dates plugin, which formats and displays dates in users' local timezones, contains a vulnerability that allows malicious actors to inject arbitrary HTML into rendered pages when Content Security Policy is modified or disabled. This could enable attackers to deface pages, steal user session cookies, or redirect users to malicious sites.
Technical details
The discourse-local-dates plugin renders user-supplied local-date format data directly as HTML via insertAdjacentHTML(), allowing HTML injection when CSP is weakened or disabled. The vulnerable code embeds unsanitized date formatting data into HTML string templates. An attacker can craft a malicious date format value in a post or message that, when rendered by other users on sites with non-default CSP, executes arbitrary JavaScript or injects HTML elements. The fix (committed 2026-07-28) replaces HTML string injection with DOM element creation methods (createElement and textContent), ensuring content is treated as text rather than markup. Patches are available in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Affected products
- Discourse Discourse prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0
Timeline
- 2026-08-10: disclosed
- 2026-07-28: patched: Security commits for HTML injection prevention merged across multiple release branches