# CVE-2026-91159: Discourse oEmbed HTML injection in iframe allowlist

Source: https://junglewise.ai/threats/cve-2026-91159-discourse-is-an-open-source-discussion-platform-prior-to-2026-9-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-91159 · Severity: high · CVSS 7.7 · Published 2026-10-14

Discourse is an open-source discussion platform that allows users to embed content from other websites via oEmbed. A malicious user with posting permission can inject styled HTML and CSS into posts by combining an allowlisted iframe with additional unrelated HTML elements, creating fake login forms or deceptive visual overlays that mislead other forum users.

Technologies: [Discourse](https://junglewise.ai/threats/technologies/discourse). Vendors: [Discourse](https://junglewise.ai/threats/vendors/discourse).

## Quick answers

**Is CVE-2026-91159 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91159 being exploited in the wild.

**How severe is CVE-2026-91159?** High severity, with a CVSS score of 7.7, published 14 October 2026.

**Which products and versions are affected?** Discourse Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.

**Is there a fix for CVE-2026-91159?** Yes: fixed in Discourse 2026.9.0, 2026.8.1, 2026.7.3, 2026.1.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91159 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-91159?** Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Discourse 2026.9.0, 2026.8.1, 2026.7.3, 2026.1.9

## Technical details

The vulnerability exists in Discourse's oEmbed processing, which failed to sanitize HTML fragments when they contained an iframe element from an allowlisted source. An attacker with a posting account who controls a public webpage and its oEmbed response can inject sibling HTML and CSS alongside the allowlisted iframe to achieve content integrity violations through visual injection attacks. The fix restricts oEmbed HTML to only allowlisted iframe elements, removing the ability to inject additional styled content.

## Affected products

- Discourse Discourse Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9

## Timeline

- 2026-10-14: disclosed

## References

- [https://github.com/discourse/discourse/commit/0953b31f5c2949d7d6ab5f6dc4c5e2f1b8bf0b22](https://github.com/discourse/discourse/commit/0953b31f5c2949d7d6ab5f6dc4c5e2f1b8bf0b22)
- [https://github.com/discourse/discourse/commit/3fc2bad6cdca47b00958330d1ee612aa141b039a](https://github.com/discourse/discourse/commit/3fc2bad6cdca47b00958330d1ee612aa141b039a)

## Related threats

- [Discourse reflected cross-site scripting in email unsubscribe](https://junglewise.ai/threats/cve-2017-20290-discourse-1-9-0-beta2-before-1-9-0-beta13-contains-a-reflected)
- [Discourse insufficient upload security metadata reconciliation](https://junglewise.ai/threats/cve-2026-91157-discourse-is-an-open-source-discussion-platform-prior-to-2026-9-0)
- [Discourse HTML injection in chat message excerpts](https://junglewise.ai/threats/cve-2026-91121-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8)
- [Discourse HTML injection in lazy video embed notifications](https://junglewise.ai/threats/cve-2026-91120-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8)
- [Discourse stored HTML injection in activity log components](https://junglewise.ai/threats/cve-2026-91119-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8)