Is CVE-2026-91121 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91121 being exploited in the wild.

How severe is CVE-2026-91121?

Medium severity, with a CVSS score of 5, published 24 September 2026.

Which products and versions are affected?

Discourse before 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

Is there a fix for CVE-2026-91121?

A patch was published on 2026-08-25: fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-91121 attacked?

It is attacked over the network.

Am I affected by CVE-2026-91121?

Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91121: Discourse HTML injection in chat message excerpts

CVE-2026-91121 · Severity: medium · CVSS 5 · Published 2026-09-24

Discourse, a discussion platform used for community engagement and internal communications, allows users to upload files to chat messages. An attacker who uploads a file with HTML markup in the filename could inject unescaped HTML that appears in chat previews, email summaries, and pinned messages, potentially altering how content is displayed to other users. While the default content security policy prevents JavaScript execution, administrators who have relaxed these protections face greater risk.

Technologies: Discourse. Vendors: Discourse.

Quick answers

Is CVE-2026-91121 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91121 being exploited in the wild.
How severe is CVE-2026-91121?: Medium severity, with a CVSS score of 5, published 24 September 2026.
Which products and versions are affected?: Discourse before 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Is there a fix for CVE-2026-91121?: A patch was published on 2026-08-25: fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91121 attacked?: It is attacked over the network.
Am I affected by CVE-2026-91121?: Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a trusted-HTML injection in chat message excerpt rendering caused by failure to escape upload filenames before displaying them in multiple excerpt contexts (channel lists, summary emails, pinned messages, reply/thread previews). An authenticated attacker can upload a file with HTML markup in its filename and trigger rendering through chat features. The fix implements proper escaping via a new upload_filename_excerpt method to sanitize filenames before display.

Affected products

Discourse Discourse before 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0

Timeline

2026-09-24: disclosed
2026-08-25: patched: fix committed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.