CVE-2026-59830 Details
Description
Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action descriptions. Viewing the affected user activity streams could execute attacker-controlled script in another user's browser. This issue is fixed in version 2026.7.0.
A stored cross-site scripting vulnerability has been identified in the Discourse post action component, affecting versions prior to 2026.7.0. The issue arises because user-controlled display names were not properly escaped before being inserted into an HTML string that was then passed to a function trusting HTML content. This flaw allowed users to embed malicious markup in post action descriptions. When these descriptions were viewed in user activity streams, the embedded scripts could execute in the context of another user's browser.
Users can upgrade to Discourse version 2026.7.0 or any of the other patched versions to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/discourse/discourse/commit/dd786594ddd088657a7e6f9fefba5bd889965fe4 | [email protected] | Source CodeVendor |
| https://github.com/discourse/discourse/releases/tag/v2026.7.0 | [email protected] | Release NotesVendor |
| https://github.com/discourse/discourse/security/advisories/GHSA-x6mf-p7cg-69rw | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Discourse | >= 0 >= 2026.6.0-latest (semver) >= 2026.5.0-latest (semver) >= 2026.1.0-latest (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |