# CVE-2026-91122: Discourse stored XSS in video placeholder component

Source: https://junglewise.ai/threats/cve-2026-91122-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91122 · Severity: high · CVSS 8.7 · Published 2026-09-24

Discourse is an open-source discussion platform used for online communities and forums. An authenticated user with basic posting privileges can inject malicious JavaScript code into video placeholder components within posts. When another user views the post and clicks the video play button, the attacker's code executes in their browser session, potentially allowing account takeover, session hijacking, or theft of sensitive information if the instance has relaxed security policies.

Technologies: [Discourse](https://junglewise.ai/threats/technologies/discourse). Vendors: [Discourse](https://junglewise.ai/threats/vendors/discourse).

## Quick answers

**Is CVE-2026-91122 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91122 being exploited in the wild.

**How severe is CVE-2026-91122?** High severity, with a CVSS score of 8.7, published 24 September 2026.

**Which products and versions are affected?** Discourse below 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

**Is there a fix for CVE-2026-91122?** A patch was published on 2026-09-24: Fixes released in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91122 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-91122?** Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the video placeholder component where the sanitizeUrl function fails to properly reject double-quoted attributes, allowing attribute breakout and injection of event handlers. An authenticated user can craft malicious HTML in a post that breaks out of the placeholder context and injects arbitrary event handlers; when another user clicks the video overlay, the handler executes with that user's privileges. Default Content Security Policy settings mitigate the risk, but instances with CSP disabled or relaxed policies are fully exploitable.

## Affected products

- Discourse Discourse below 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0

## Timeline

- 2026-09-24: disclosed
- 2026-09-24: patched: Fixes released in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0

## References

- [https://github.com/discourse/discourse/commit/05d92b8749f68d2626cbe65ec7adde7562a0283d](https://github.com/discourse/discourse/commit/05d92b8749f68d2626cbe65ec7adde7562a0283d)
- [https://github.com/discourse/discourse/commit/5674b3e6594825c28d2678e55057fd6802f11031](https://github.com/discourse/discourse/commit/5674b3e6594825c28d2678e55057fd6802f11031)

## Related threats

- [Discourse reflected cross-site scripting in email unsubscribe](https://junglewise.ai/threats/cve-2017-20290-discourse-1-9-0-beta2-before-1-9-0-beta13-contains-a-reflected)
- [Discourse oEmbed HTML injection in iframe allowlist](https://junglewise.ai/threats/cve-2026-91159-discourse-is-an-open-source-discussion-platform-prior-to-2026-9-0)
- [Discourse insufficient upload security metadata reconciliation](https://junglewise.ai/threats/cve-2026-91157-discourse-is-an-open-source-discussion-platform-prior-to-2026-9-0)
- [Discourse HTML injection in chat message excerpts](https://junglewise.ai/threats/cve-2026-91121-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8)
- [Discourse HTML injection in lazy video embed notifications](https://junglewise.ai/threats/cve-2026-91120-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8)