EUVD-2026-60236Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Unauthenticated network injection (PR:N, AV:N, AC:L) but a victim must load the page (UI:R); CSP bypass into the browser security context is a scope change (S:C) with high confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted color_scheme_id (or dark_scheme_id) cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered into a color scheme tag without escaping, the attacker could break out of the attribute and inject a tag that bypassed Discourse's nonce-based Content Security Policy, resulting in arbitrary JavaScript execution in visitors' browsers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
AnalysisAI
Stored/reflected cross-site scripting in Discourse before 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 lets an unauthenticated attacker execute arbitrary JavaScript in a visitor's browser by supplying a crafted color_scheme_id or dark_scheme_id cookie. Because the cookie is rendered into a color-scheme tag without HTML escaping, an attacker can break out of the attribute context and inject markup that defeats Discourse's nonce-based Content Security Policy. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the crafted value be delivered in the victim's color_scheme_id or dark_scheme_id cookie and that the victim then load a Discourse page that renders the color-scheme tag; per the CVSS vector (PR:N) no authentication is needed to trigger the injection, but UI:R means a victim must visit/load the affected page for script execution to occur. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely consistent and point to a genuine high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, score 9.3) indicates a network-reachable, low-complexity, unauthenticated attack with a scope change, tempered only by the required user interaction (a victim must load an affected page in a state where the malicious cookie is present). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0, choosing the fixed release that matches your current branch (for example, a 2026.6.x instance should move to 2026.6.1). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Discourse instances and current versions to identify systems running affected releases (versions prior to 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today