CVE-2026-91119

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form action_code_who value into mention-link href attributes without URL encoding. A quote-bearing display name could terminate the intended URL attribute and inject attacker-controlled elements into the trusted rendered markup. Although the visible mention text was escaped, the unencoded path component allowed stored HTML injection when another user viewed the affected topic action or activity log. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

• CWE-79

• https://github.com/discourse/discourse/commit/20dbf112760eb1d6a58f2e49aeef7546898b6f1c
• https://github.com/discourse/discourse/commit/66653c484cfb91bc346f9a326f6945387f17b035
• https://github.com/discourse/discourse/commit/77a81c7a3a7ff9e94b355e32b8f379f2d389e05a
• https://github.com/discourse/discourse/commit/c4748f651d9d2f3a6dd3106a4d5564536c645168
• https://github.com/discourse/discourse/pull/42882
• https://github.com/discourse/discourse/security/advisories/GHSA-pv3p-p3m9-v8v3

Published

Sep 24, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-91102HP has identified and remediated multiple externally reporte…9.8
• CVE-2026-91103HP has identified and remediated multiple externally reporte…9.8
• CVE-2026-91104HP has identified and remediated multiple externally reporte…9.8
• CVE-2026-91105HP has identified and remediated multiple externally reporte…9.8
• CVE-2026-91106HP has identified and remediated multiple externally reporte…9.8
• CVE-2026-9111Use after free in WebRTC in Google Chrome on Linux prior to …8.8
• CVE-2026-9112Use after free in GPU in Google Chrome on Windows prior to 1…8.8
• CVE-2026-91120Discourse is an open-source discussion platform. Prior to 20…5.4
• CVE-2026-91121Discourse is an open-source discussion platform. Prior to 20…5
• CVE-2026-91122Discourse is an open-source discussion platform. Prior to 20…8.7
• CVE-2026-91123Discourse is an open-source discussion platform. Prior to 20…7.2
• CVE-2026-91127File Viewer is a browser-native viewer for Office, PDF, CAD,…8.2