What is the CVSS score of CVE-2026-72720?

CVE-2026-72720 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-72720?

Yes, a patch is available for CVE-2026-72720. Update the affected software to the latest version immediately.

Discourse CVE-2026-72720

EUVD-2026-55656 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-10 GitHub_M

XSS Discourse

6.4

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

Low-privilege authenticated attacker posts crafted content; injection propagates to email recipients outside Discourse scope yielding S:C, with low C/I and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Aug 10, 2026 - 17:03 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 16:32 vuln.today

Analysis Generated

Aug 10, 2026 - 16:32 vuln.today

CVE Published

Aug 10, 2026 - 15:41 cve.org

MEDIUM 6.4

DescriptionCVE.org

Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.format_for_email because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag data-slug values can cause decoded attribute text to be reinterpreted as HTML. The vulnerable conversion also fails to strictly validate the Vimeo iframe host and path, allowing non-Vimeo allowlisted iframes to be converted. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.

AnalysisAI

HTML injection in Discourse's PrettyText.format_for_email function allows authenticated users to embed arbitrary markup into outbound email notifications across all versions prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1. Three distinct code paths in the email conversion pipeline re-inject cooked HTML attribute values as raw markup strings rather than treating them as data - exploitable via crafted Vimeo iframe sources, secure-upload URLs or dimension attributes, and hashtag data-slug values. No public exploit code or CISA KEV listing is identified at time of analysis; the CVSS 3.1 score of 6.4 reflects a meaningful scope change to email recipients' clients combined with the low-privilege authentication requirement.

Technical ContextAI

Discourse's Ruby-based PrettyText module converts stored Nokogiri-parsed HTML ('cooked' posts) into email-safe markup via format_for_email. The root cause maps to CWE-79 (Improper Neutralization of Input During Web Page Generation): three independent code paths interpolate attribute values directly into HTML strings rather than using Nokogiri's DOM API. First, hashtag data-slug attributes were passed through hashtag.replace() as a raw interpolated string, allowing injected tag payloads in slug values. Second, convert_vimeo_iframes used Nokogiri::HTML5.fragment() with unsanitized string interpolation and did not enforce that the iframe src host matched player.vimeo.com or that the path matched a /video/<id> pattern - letting non-Vimeo, allowlist-bypassing iframes generate injected HTML output. Third, the strip_secure_uploads path constructed its notice div via a heredoc string, embedding URL and numeric dimension attributes without sanitization. The onebox origin regex was also insufficiently anchored, permitting host-prefix bypass. All four fixes in PRs 42244-42247 replace string interpolation with DOM construction methods (create_element, create_text_node, add_child), strictly validate Vimeo host and path against compiled constants, and tighten origin boundary anchoring. Affected CPE: cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade Discourse to a patched release immediately: 2026.1.7 for the stable-1.x branch, 2026.6.2 for the June stable track, 2026.7.1 for the July stable track, or 2026.8.0-latest.1 for the beta/latest track. All four fixes are documented in GitHub Security Advisory GHSA-3q6f-6gm9-m35v and merged via pull requests 42244, 42245, 42246, and 42247 in the discourse/discourse repository. If an immediate upgrade is not operationally feasible, the most effective compensating control is to disable outbound email notifications entirely via Admin > Email settings, which prevents the vulnerable format_for_email code path from executing - though this eliminates all digest and topic notification emails, which may be unacceptable operationally. Restricting membership to trusted users (disabling open registration and raising the minimum trust level required for posting) reduces the attacker pool but does not eliminate the vulnerability if any member account could be compromised or is malicious. Disabling Vimeo onebox embedding or the secure-upload feature individually would close those specific attack vectors but does not address the hashtag slug injection path. No single configuration toggle eliminates all three vectors without patch.