CVE-2021-39161

Discourse is an open source platform for community discussion. In affected versions category names can be used for Cross-site scripting(XSS) attacks. This is mitigated by Discourse's default Content Security Policy and this vulnerability only affects sites which have modified or disabled or changed Discourse's default Content Security Policy have allowed for moderators to modify categories. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.

• CWE-79
• CWE-79

• https://github.com/discourse/discourse/security/advisories/GHSA-xhmc-9jwm-wqphThird Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-xhmc-9jwm-wqphThird Party Advisory

Published

Aug 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39156Istio is an open source platform for providing a uniform way…7.5
• CVE-2021-39157detect-character-encoding is an open source character encodi…7.5
• CVE-2021-39158NVCaffe's python required dependencies list used to contain …8.8
• CVE-2021-39159BinderHub is a kubernetes-based cloud service that allows us…9.8
• CVE-2021-3916bookstack is vulnerable to Improper Limitation of a Pathname…6.5
• CVE-2021-39160nbgitpuller is a Jupyter server extension to sync a git repo…8.8
• CVE-2021-39162Pomerium is an open source identity-aware access proxy. Envo…8.6
• CVE-2021-39163Matrix is an ecosystem for open federated Instant Messaging …3.1
• CVE-2021-39164Matrix is an ecosystem for open federated Instant Messaging …3.1
• CVE-2021-39165Cachet is an open source status page. With Cachet prior to a…6.5
• CVE-2021-39166Pimcore is an open source data & experience management platf…5.4
• CVE-2021-39167OpenZepplin is a library for smart contract development. In …9.8