CyberRota Analysis
AI-GeneratedThe discourse-local-dates plugin in Discourse prior to specified versions is vulnerable to rendering crafted local-date format data as HTML, which can lead to potential cross-site scripting (XSS) attacks on sites with a modified or disabled default Content Security Policy. While the severity is classified as low, organizations using affected versions should prioritize updating to the fixed releases to mitigate any risk of exploitation. Users of the Discourse platform, particularly those who have altered their Content Security Policy, should take immediate action to ensure their systems are secure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse-local-dates plugin rendered crafted local-date format data as HTML on sites with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.