CVE-2017-20290 Details
Description
Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb renders unescaped via html_safe, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
A reflected cross-site scripting vulnerability has been identified in Discourse versions 1.9.0.beta2 prior to 1.9.0.beta13. This vulnerability allows unauthenticated attackers to inject scripts via the email parameter of the /email/unsubscribed endpoint. Exploitation involves crafting GET requests with SVG onload payloads, which are rendered unescaped by the unsubscribed.html.erb template. This execution of JavaScript occurs in the browsers of affected users.
Users can update to Discourse version 1.9.0.beta13 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Discourse | >= 1.9.0.beta2, < 1.9.0.beta13 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |