Discourse CVE-2026-72729

Exploitation requires two concurrent conditions: first, the attacker must be an authenticated Discourse user (PR:L) with posting privileges, as the payload is embedded in post content via the discourse-local-dates span element attributes; second, the victim instance must have its default Content Security Policy modified or explicitly disabled - Discourse's default CSP prevents XSS payloads from executing, making this a non-default misconfiguration prerequisite. Additionally, a victim user must actively view (UI:A) the post containing the crafted date element. Sites running Discourse with the unmodified default CSP are not exploitable even on unpatched versions. Exploitation is limited to confidentiality and integrity at low impact (VC:L/VI:L) - no availability impact is assessed.

Real-world risk is constrained by multiple stacked requirements that reduce practical exploitability significantly below what the CWE alone might suggest. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N) encodes three key limiters: AT:P signals a specific prerequisite attack condition (CSP must be modified or disabled - this is non-default Discourse behavior), PR:L requires the attacker to be an authenticated forum user, and UI:A requires a victim to actively view the injected post. Discourse's default CSP would block most XSS payloads even if injection occurred, so the vulnerability only materializes on misconfigured instances. The resulting CVSS 4.0 score of 2.0 is consistent with this stacked-condition reality. No KEV listing, no standalone POC, and no EPSS data are available - there are no external exploitation signals elevating priority. This is a genuine low-severity defect worth patching in the normal update cycle but does not warrant emergency response unless the target instance is known to run with a weakened or disabled CSP.

An authenticated Discourse forum member posts a message containing a local-date span element with a crafted data-format attribute embedding an HTML payload (e.g., data-format="[<img src=x onerror=alert(document.cookie)>]"). When another logged-in user visits the thread on an instance where the default CSP has been modified or disabled, the plugin's applyLocalDates function interpolates the attacker-controlled format string directly into the DOM as HTML, executing the payload in the victim's browser context. The vulnerability is confirmed exploitable via test cases in the fix commits that demonstrate data-format, data-timezone, and data-displayed-timezone as injection vectors.