CVE-2026-91120

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could create a post for an enabled YouTube, Vimeo, or TikTok provider whose title contained markup, and the email and chat-summary rendering path would place that markup into the output instead of treating it solely as text. Recipients using HTML-capable email clients could see injected content, potentially including event handlers, but the issue did not directly expose a Discourse browser session or affect the forum page itself. Lazy video embeds must be enabled, which is the default configuration. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

• CWE-79

• https://github.com/discourse/discourse/commit/6bf1cdcb3ae1aa146e1fd953a62046bf4a1f143f
• https://github.com/discourse/discourse/commit/8338919df4ecbd0fb85314b762772cc033b764e3
• https://github.com/discourse/discourse/commit/e7de8285203a2edf85beff3b951e66aeb7e5dc76
• https://github.com/discourse/discourse/commit/ed8b47df80bcc9f0bd70773fc399c9386f9d52dd
• https://github.com/discourse/discourse/pull/42882
• https://github.com/discourse/discourse/security/advisories/GHSA-h7cg-2vww-m45c

Published

Sep 24, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-91104HP has identified and remediated multiple externally reporte…9.8
• CVE-2026-91105HP has identified and remediated multiple externally reporte…9.8
• CVE-2026-91106HP has identified and remediated multiple externally reporte…9.8
• CVE-2026-9111Use after free in WebRTC in Google Chrome on Linux prior to …8.8
• CVE-2026-91119Discourse is an open-source discussion platform. Prior to 20…6.4
• CVE-2026-9112Use after free in GPU in Google Chrome on Windows prior to 1…8.8
• CVE-2026-91121Discourse is an open-source discussion platform. Prior to 20…5
• CVE-2026-91122Discourse is an open-source discussion platform. Prior to 20…8.7
• CVE-2026-91123Discourse is an open-source discussion platform. Prior to 20…7.2
• CVE-2026-91127File Viewer is a browser-native viewer for Office, PDF, CAD,…8.2
• CVE-2026-91129Home Assistant is open source home automation software focus…5.4
• CVE-2026-9113Out of bounds read in GPU in Google Chrome on Mac prior to 1…4.3