CyberRota Analysis
AI-GeneratedThe vulnerability affects the Discourse open-source discussion platform, specifically in versions prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, where insufficient normalization and escaping of a topic's "featured link" can allow for JavaScript injection. This could lead to potential cross-site scripting (XSS) attacks, particularly if the Content Security Policy is modified or disabled. Organizations using affected versions should prioritize upgrading to the patched releases to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic "featured link" was not sufficiently normalized and escaped before being rendered in the topic list, allowing a user who can set a featured link to inject JavaScript when default Content Security Policy protections were modified or disabled. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Related CVEs
Other vulnerabilities affecting the same vendor(s)