Discourse EUVD-2026-86307

Requires an authenticated account (PR:L) whose attacker-controlled display name propagates into the free-form action_code_who value rendered by the topic small-action or nested-activity-log components; the payload must contain a double-quote to terminate the mention-link href attribute. Exploitation triggers passively when another user views the affected topic action or activity log (UI:N for the attacker). Limiting factors: only versions before 2026.1.8/2026.6.3/2026.7.2/2026.8.0 are affected; the visible mention text is already escaped so only the href path component is injectable; and Discourse's default Content-Security-Policy restricts inline script/event handlers, so full JavaScript execution is realistic mainly on instances that relax or disable CSP, with default deployments limited to trusted-HTML/element injection.

This is a genuine but moderate-severity issue, not a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N = 6.4) reflects a network-reachable, low-complexity stored injection requiring only a low-privileged authenticated account (any user able to set a quote-bearing display name that becomes action_code_who) and no victim interaction beyond viewing the affected topic action or activity log. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is: no public exploit identified at time of analysis. Critically, the description and PR diff show this is stored HTML injection into TRUSTED rendered markup - the visible mention text is already HTML-escaped, and the demonstrated payload is an <img> attribute breakout ("><img src=x>), not confirmed arbitrary JavaScript execution; Discourse's default Content-Security-Policy would block inline event handlers, limiting most deployments to markup injection rather than full session-stealing XSS (consistent with siblings CVE-2026-91121/91122 in the same PR#42882 batch). The C:L/I:L/A:N impact ratings are honest for that reality. Net: patch in the normal cycle - real, remotely reachable, but bounded by low privileges and default CSP.

A low-privileged authenticated Discourse user sets a display name containing a double-quote breakout payload (e.g. "><img src=x onerror=...>). When that name is surfaced as action_code_who in a topic small-action or nested activity-log entry, it is interpolated into a mention-link href without URL encoding, terminating the attribute and injecting attacker-controlled HTML into the trusted markup that renders for any other user who views that topic action or activity log. No public exploit code is available, and under Discourse's default CSP the practical outcome is HTML/element injection rather than confirmed script execution.