# CVE-2026-72729: Discourse discourse-local-dates HTML injection

Source: https://junglewise.ai/threats/cve-2026-72729-discourse-discourse-local-dates-html-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-72729 · Severity: info · Published 2026-08-10

Discourse is an open-source community discussion platform used by organizations to host forums and conversations. The discourse-local-dates plugin, which formats and displays dates in users' local timezones, contains a vulnerability that allows malicious actors to inject arbitrary HTML into rendered pages when Content Security Policy is modified or disabled. This could enable attackers to deface pages, steal user session cookies, or redirect users to malicious sites.

Technologies: [Discourse](https://junglewise.ai/threats/technologies/discourse). Vendors: [Discourse](https://junglewise.ai/threats/vendors/discourse).

## Quick answers

**Is CVE-2026-72729 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72729 being exploited in the wild.

**How severe is CVE-2026-72729?** Informational severity, published 10 August 2026.

**Which products and versions are affected?** Discourse prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

**Is there a fix for CVE-2026-72729?** A patch was published on 2026-07-28: Security commits for HTML injection prevention merged across multiple release branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-72729 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-72729?** Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The discourse-local-dates plugin renders user-supplied local-date format data directly as HTML via insertAdjacentHTML(), allowing HTML injection when CSP is weakened or disabled. The vulnerable code embeds unsanitized date formatting data into HTML string templates. An attacker can craft a malicious date format value in a post or message that, when rendered by other users on sites with non-default CSP, executes arbitrary JavaScript or injects HTML elements. The fix (committed 2026-07-28) replaces HTML string injection with DOM element creation methods (createElement and textContent), ensuring content is treated as text rather than markup. Patches are available in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

## Affected products

- Discourse Discourse prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0

## Timeline

- 2026-08-10: disclosed
- 2026-07-28: patched: Security commits for HTML injection prevention merged across multiple release branches

## References

- [https://github.com/discourse/discourse/commit/9768f476ed86ea202440cd2b6245af8a4f94ec69](https://github.com/discourse/discourse/commit/9768f476ed86ea202440cd2b6245af8a4f94ec69)
- [https://github.com/discourse/discourse/commit/981ba23d33d2e2d98f6690734116af58f2cea938](https://github.com/discourse/discourse/commit/981ba23d33d2e2d98f6690734116af58f2cea938)

## Related threats

- [Discourse reflected cross-site scripting in email unsubscribe](https://junglewise.ai/threats/cve-2017-20290-discourse-1-9-0-beta2-before-1-9-0-beta13-contains-a-reflected)
- [Discourse oEmbed HTML injection in iframe allowlist](https://junglewise.ai/threats/cve-2026-91159-discourse-is-an-open-source-discussion-platform-prior-to-2026-9-0)
- [Discourse insufficient upload security metadata reconciliation](https://junglewise.ai/threats/cve-2026-91157-discourse-is-an-open-source-discussion-platform-prior-to-2026-9-0)
- [Discourse HTML injection in chat message excerpts](https://junglewise.ai/threats/cve-2026-91121-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8)
- [Discourse HTML injection in lazy video embed notifications](https://junglewise.ai/threats/cve-2026-91120-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8)