Is there a patch available for CVE-2026-72729?

Yes, a patch is available for CVE-2026-72729. Update the affected software to the latest version immediately.

Discourse CVE-2026-72729

Q: What is the CVSS score of CVE-2026-72729?

CVE-2026-72729 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-55669 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-08-10 GitHub_M

XSS Discourse

2.0

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.4 MEDIUM

AC:H reflects the non-default CSP-disabled prerequisite; PR:L for required authentication; UI:R for victim viewing; S:C because XSS crosses into victim browser context.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Aug 10, 2026 - 17:03 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 16:51 vuln.today

Analysis Generated

Aug 10, 2026 - 16:51 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse-local-dates plugin rendered crafted local-date format data as HTML on sites with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

AnalysisAI

Cross-site scripting in Discourse's discourse-local-dates plugin allows an authenticated attacker to inject arbitrary HTML by embedding crafted markup in local-date format attributes (data-format, data-displayed-timezone, data-timezone), which were interpolated directly into the DOM via template literals instead of safe DOM text APIs. Exploitation is gated by a non-default condition: the site's Content Security Policy must be modified or disabled from the default. No public exploit independent of the vendor fix commits exists at time of analysis, and this is not listed in CISA KEV. The CVSS 4.0 score of 2.0 reflects the constrained attack requirements (AT:P, PR:L, UI:A).

Technical ContextAI

Discourse (cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*) is a Ruby on Rails/Ember.js open-source forum platform. The discourse-local-dates plugin processes span elements carrying data-date, data-time, data-format, data-timezone, and data-displayed-timezone HTML attributes, converting them to localized date representations. The vulnerable code path in plugins/discourse-local-dates/assets/javascripts/initializers/discourse-local-dates.js used JavaScript template literal string interpolation (${localDateBuilder.formatted}) to build inner HTML, meaning attacker-controlled values in those data attributes were rendered as raw HTML rather than escaped text. CWE-79 (Stored/Reflected XSS) is the root cause class - the plugin failed to distinguish between data and markup when inserting user-influenced content into the DOM. The fix replaces string interpolation with document.createElement() + textContent assignment, ensuring values are always treated as plain text regardless of content.

RemediationAI

Upgrade Discourse to one of the patched versions: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0, depending on the release branch in use. Patch commits are available at https://github.com/discourse/discourse/commit/9768f476ed86ea202440cd2b6245af8a4f94ec69, https://github.com/discourse/discourse/commit/981ba23d33d2e2d98f6690734116af58f2cea938, https://github.com/discourse/discourse/commit/a7e509bfa1aa6288b447503de6ef798c31a62751, and https://github.com/discourse/discourse/commit/d5d5055fbdf04d5bd72fcaa7e4257fac5adac049. As a compensating control for sites that cannot immediately update, ensure Discourse's default Content Security Policy is enabled and unmodified - this alone prevents the XSS payload from executing even in the presence of the injection. Disabling or weakening CSP is the activation condition for this vulnerability, so restoring the default CSP eliminates exploitability without requiring the plugin patch. No trade-offs exist in re-enabling the default CSP beyond possible breakage of custom third-party integrations that depend on relaxed CSP directives.