Executive brief
Discourse is an open-source discussion platform used for online communities and forums. An authenticated user with basic posting privileges can inject malicious JavaScript code into video placeholder components within posts. When another user views the post and clicks the video play button, the attacker's code executes in their browser session, potentially allowing account takeover, session hijacking, or theft of sensitive information if the instance has relaxed security policies.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the video placeholder component where the sanitizeUrl function fails to properly reject double-quoted attributes, allowing attribute breakout and injection of event handlers. An authenticated user can craft malicious HTML in a post that breaks out of the placeholder context and injects arbitrary event handlers; when another user clicks the video overlay, the handler executes with that user's privileges. Default Content Security Policy settings mitigate the risk, but instances with CSP disabled or relaxed policies are fully exploitable.
Affected products
- Discourse Discourse below 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0
Timeline
- 2026-09-24: disclosed
- 2026-09-24: patched: Fixes released in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0