EUVD-2026-42733Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as featured-link-capable user
-
DeliverySet topic featured link with JS payload
-
ExploitPayload stored in topic list
-
ExecutionVictim views topic list
-
PersistCSP-weakened page executes script
-
ImpactHijack victim session/act as user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires all of the following: (1) an authenticated account with permission to set a topic "featured link" (PR:L); (2) the target instance must have its default Content Security Policy modified or disabled - on the shipped default CSP the injected JavaScript is blocked and the attack fails (this is the AT:P attack requirement); and (3) a victim must load the topic list where the malicious featured link is rendered (UI:P). Limiting factors: the non-default CSP prerequisite excludes the large fraction of installs running the hardened default configuration, the authentication/permission requirement excludes anonymous attackers, and the need for a victim to view the list means execution is not attacker-controlled in timing. |
| Impact | The vendor CVSS 4.0 score is 7.4 (High) with vector AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N. Several signals temper the raw number: AT:P (attack requirement) encodes the non-default prerequisite that the default CSP must be modified or disabled, PR:L requires an authenticated account able to set a featured link, and UI:P requires a victim to view the topic list. There is no EPSS score in the input, no POC or exploit code referenced, and no CISA KEV listing, so this is best treated as a real-but-conditional web vulnerability rather than a mass-exploitation emergency. The high VC:H/VI:H reflect full compromise of the victim's browser session/DOM (session theft, actions as the victim, including potential admin takeover if an admin views the list), but the combination of authentication, a modified-CSP precondition, and required user interaction meaningfully narrows the exploitable population. Prioritize patching for instances that run a customized or relaxed CSP; instances on the shipped default CSP are protected in depth. |
| Exploit ScenarioDerived | An attacker with a low-trust authenticated account on a Discourse instance whose administrators have relaxed or removed the default CSP creates or edits a topic and sets a malicious featured link crafted to inject JavaScript. When another user - potentially a moderator or admin - browses the topic list containing that entry, the script executes in their session, enabling session/cookie theft or actions performed as the victim. No public exploit code was identified, and successful attack requires both the weakened-CSP configuration and victim interaction (AC:L/AT:P/UI:P). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 09, 2026
Stored cross-site scripting in Discourse (before 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5) lets a user with permission to set a topic "featured link" inject JavaScript that executes when the link is rendered in the topic list. Exploitation only succeeds where the platform's default Content Security Policy has been weakened or disabled, so out-of-the-box installs are protected in depth. No public exploit identified at time of analysis, and the issue is not in CISA KEV; official fixed releases are available.
RemediationAI
Vendor-released patch: upgrade to 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5 (choose the fixed release on your current branch) per advisory GHSA-695w-7fv8-mxg3; the fix corresponds to commits 1bce8881e4253d9bbab56f011a12ef899b926b59, 6679d9a5083488bae10c2adbb345c481c583242c, 6828aee9b15c2655d63b515ac919830bd540ff83, and c9b9405f5bd0bf0269e505e28e3aad388d7657c5. As the most effective compensating control until you patch, re-enable and stop weakening Discourse's default Content Security Policy, since the CVE is only exploitable when that CSP is modified or disabled - the trade-off is that custom themes/plugins relying on inline scripts or external origins may need CSP allowances rather than a blanket relaxation. Additionally, restrict who can set featured links by tightening the trust level / category permissions required to create or edit topics with featured links, and audit existing featured links for suspicious javascript: or markup payloads; the side effect is reduced convenience for lower-trust users.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Discourse is a widely used open-source Ruby on Rails discussion/forum platform. The flaw is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) stored XSS: the topic "featured link" value is persisted and later echoed into the topic-list view without sufficient normalization and output escaping, allowing a crafted URL/attribute to break out into an executable JavaScript context (e.g., a javascript: URI or injected markup). Discourse ships a hardened default Content Security Policy that blocks inline/script execution, which is why the bug is only exploitable when that CSP is customized away or turned off. No CPE strings were supplied in the input; affected products are identified from the vendor advisory and release tags rather than NVD CPE data.
Know when Discourse gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
AC:H and UI:R capture the required non-default weakened-CSP config plus victim viewing the list; PR:L for the authenticated featured-link setter; S:C and C/I:L for cross-context script execution in the victim's browser.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
1DescriptionCVE.org
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic "featured link" was not sufficiently normalized and escaped before being rendered in the topic list, allowing a user who can set a featured link to inject JavaScript when default Content Security Policy protections were modified or disabled. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Executive ViewAI
A stored cross-site scripting vulnerability in Discourse (CVE-2026-55424) affects community platforms that have modified their default Content Security Policy, risking exposure of member accounts and sensitive discussion data. Patched versions are available immediately; no public exploit has been identified to date.
Apply vendor patch. If patching is delayed: restrict 'set featured link' permission to trusted administrators and verify Content Security Policy settings are not configured to disable XSS protections.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Discourse versions prior to 3.5.0.beta6 contain a reflected cross-site scripting (XSS) vulnerability in social login fun
discourse-bbcode is the official BBCode plugin for Discourse. Rated critical severity (CVSS 9.8), this vulnerability is
Unauthorized information disclosure in Discourse discussion platform versions prior to 2026.3.0-latest.1, 2026.2.1, and
Discourse is an open source platform for community discussion. Rated high severity (CVSS 8.2), this vulnerability is rem
Discourse versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 contain an insecure direct object reference (IDOR) in the
In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms. Rated
Unauthenticated attackers can submit forged webhook payloads to multiple email provider integrations in Discourse versio
Discourse is an open-source discussion platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploi
Discourse is an open source platform for community discussion. Rated medium severity (CVSS 5.9), this vulnerability is r
Discourse versions prior to 3.4.4 (stable), 3.5.0.beta5 (beta), and 3.5.0.beta6-dev (tests-passed) contain a critical vu
Discourse is an open source platform for community discussion. Rated critical severity (CVSS 9.8), this vulnerability is
Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. Rated critical severity (CVSS 9.8
Exploit-DB