What is the CVSS score of CVE-2026-53962?

CVE-2026-53962 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-53962?

Yes, a patch is available for CVE-2026-53962. Update the affected software to the latest version immediately.

Discourse CVE-2026-53962

EUVD-2026-42734 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-09 security-advisories@github.com

XSS Discourse

5.4

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L because any registered user can upload SVGs; UI:R because victim must navigate to specific non-standard URLs; S:C for cross-origin JavaScript execution in victim's browser context.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 09, 2026 - 23:02 EUVD

Analysis Generated

Jul 09, 2026 - 22:46 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, insufficient SVG sanitization in upload and user avatar handling could lead to cross-site scripting when a user visited specific URLs that are not normally part of community browsing. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

AnalysisAI

Stored cross-site scripting in Discourse's SVG upload and user avatar handling allows authenticated users to inject malicious JavaScript that executes in victims' browsers when they visit specific non-standard URLs. The CVSS scope change (S:C) reflects that successful exploitation crosses the browser security boundary, enabling session token theft or account takeover against victims who visit the triggering URL. Vendor-confirmed patches are available across four release branches; no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Discourse is a Ruby on Rails-based open-source forum platform widely self-hosted by communities and organizations. The flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) stems from insufficient sanitization of SVG files submitted through upload and avatar handling workflows. SVG is an XML-based vector format that legally supports embedded JavaScript via inline <script> elements, event handler attributes (onload, onerror, onclick), and javascript: URIs - making it a well-known XSS vector when not properly sanitized before browser rendering. The CVSS vector S:C (scope change) indicates the injected script executes outside the origin of the vulnerable component, consistent with same-origin policy bypass patterns common in avatar/upload serving contexts. Four upstream commits (3ee8343, 810c271, 92a699d, b8ceb49) address the sanitization logic across affected branches.

RemediationAI

The primary fix is to upgrade Discourse to one of the vendor-patched releases: v2026.6.0, v2026.5.1, v2026.4.2, or v2026.1.5, all available via the GitHub releases page (https://github.com/discourse/discourse/releases). The underlying fixes are delivered across four commits (3ee8343, 810c271, 92a699d, b8ceb49) and are confirmed by the vendor advisory GHSA-jmcf-3367-78vv. As a compensating control pending upgrade, administrators can remove 'svg' from the allowed upload extensions in Admin Settings under Files → authorized_extensions - this eliminates the SVG attack surface entirely at the cost of disabling SVG avatar and attachment support for all users. No other specific workarounds are documented in the available references.