Vulnerability · Published Oct 14, 2026 · Assigned by GitHub_M
CVE-2026-91159Discourse: Stored oEmbed HTML injection via allowed iframe
High 7.7
In plain English
A high-severity cross-site scripting in discourse from discourse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permission who controlled a public webpage and its oEmbed response could combine an allowlisted iframe with unrelated sibling HTML or CSS, causing stored visual overlays or other styled content to appear in post content and enabling misleading or fraudulent user interfaces. Exploitation requires a posting account, control of the fetched webpage and oEmbed response, and an allowlisted iframe source. The issue affects content integrity but does not expose restricted data, disrupt availability, or require interaction with Discourse Content Security Policy. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
References
- https://github.com/discourse/discourse/security/advisories/GHSA-f9jx-vv33-4282 x_refsource_CONFIRM
- https://github.com/discourse/discourse/commit/0953b31f5c2949d7d6ab5f6dc4c5e2f1b8bf0b22 x_refsource_MISC
- https://github.com/discourse/discourse/commit/3fc2bad6cdca47b00958330d1ee612aa141b039a x_refsource_MISC
- https://github.com/discourse/discourse/commit/dde8bc4fb6200139f5eff7e100b0f3e829d37ab3 x_refsource_MISC
- https://github.com/discourse/discourse/commit/ed6f83f123d1a4c6c6c7e64c8a2233e3cb6a28d7 x_refsource_MISC