# CVE-2026-91134: Discourse post sanitizer iframe bypass via encoded userinfo

Source: https://junglewise.ai/threats/cve-2026-91134-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91134 · Severity: medium · CVSS 5.4 · Published 2026-09-24

Discourse, a popular community discussion platform, contains a vulnerability in how it filters embedded content (iframes) in user posts. An attacker with posting privileges can embed malicious cross-origin content that appears safe to the content filter by encoding the URL in a specific way, allowing attacker-controlled websites to load within trusted pages. This could lead to data theft, session hijacking, or malware distribution to community members.

Technologies: [Discourse](https://junglewise.ai/threats/technologies/discourse). Vendors: [Discourse](https://junglewise.ai/threats/vendors/discourse).

## Quick answers

**Is CVE-2026-91134 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91134 being exploited in the wild.

**How severe is CVE-2026-91134?** Medium severity, with a CVSS score of 5.4, published 24 September 2026.

**Which products and versions are affected?** Discourse Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

**Is there a fix for CVE-2026-91134?** A patch was published on 2026-01-08: Fixed in Discourse 2026.1.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91134 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-91134?** Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The post sanitizer validates iframe URLs inconsistently: it checks an encoded form against an allowlist prefix policy but the browser interprets a decoded form, creating a mismatch that allows bypassing the allowed_iframes allowlist. An authenticated user with posting privileges can persist a crafted iframe in a post, causing the browser to render attacker-controlled cross-origin content. The vulnerability exists in the sanitizer.js component and is fixed by properly validating URLs in their final decoded form before comparing against security policies.

## Affected products

- Discourse Discourse Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0

## Timeline

- 2026-09-24: disclosed: CVE-2026-91134 published
- 2026-01-08: patched: Fixed in Discourse 2026.1.8
- 2026-06-03: patched: Fixed in Discourse 2026.6.3
- 2026-07-02: patched: Fixed in Discourse 2026.7.2
- 2026-08-00: patched: Fixed in Discourse 2026.8.0

## References

- [https://github.com/discourse/discourse/commit/0a8015e6c7a5079981843721494d30c9a91f5415](https://github.com/discourse/discourse/commit/0a8015e6c7a5079981843721494d30c9a91f5415)
- [https://github.com/discourse/discourse/commit/1304b0c04f87534053b0d574ae5a9b9ba13dd590](https://github.com/discourse/discourse/commit/1304b0c04f87534053b0d574ae5a9b9ba13dd590)

## Related threats

- [Discourse reflected cross-site scripting in email unsubscribe](https://junglewise.ai/threats/cve-2017-20290-discourse-1-9-0-beta2-before-1-9-0-beta13-contains-a-reflected)
- [Discourse oEmbed HTML injection in iframe allowlist](https://junglewise.ai/threats/cve-2026-91159-discourse-is-an-open-source-discussion-platform-prior-to-2026-9-0)
- [Discourse insufficient upload security metadata reconciliation](https://junglewise.ai/threats/cve-2026-91157-discourse-is-an-open-source-discussion-platform-prior-to-2026-9-0)
- [Discourse HTML injection in chat message excerpts](https://junglewise.ai/threats/cve-2026-91121-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8)
- [Discourse HTML injection in lazy video embed notifications](https://junglewise.ai/threats/cve-2026-91120-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8)