CVE-2026-91121

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was then interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. The issue allowed trusted-HTML injection that altered rendered excerpt content, but JavaScript execution was not demonstrated with default Content Security Policy settings. The advisory states that no confidentiality, integrity, or availability impact was identified, while its structured scoring metadata separately assigns low integrity impact. Sites that disable or relax the default CSP have increased exposure. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

• CWE-79

• https://github.com/discourse/discourse/commit/24cd7cc4c868f20e6037d67d801d60c3e289b278
• https://github.com/discourse/discourse/commit/6e7a181909c34a059d2b0a6291335a363205b787
• https://github.com/discourse/discourse/commit/9d6f5e64a1cb68e8208520e4209b361e14f7394b
• https://github.com/discourse/discourse/commit/af197941f7613a3845cba21d217641c77c8ef836
• https://github.com/discourse/discourse/pull/42882
• https://github.com/discourse/discourse/security/advisories/GHSA-34rh-wjfv-65gq

Published

Sep 24, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-91105HP has identified and remediated multiple externally reporte…9.8
• CVE-2026-91106HP has identified and remediated multiple externally reporte…9.8
• CVE-2026-9111Use after free in WebRTC in Google Chrome on Linux prior to …8.8
• CVE-2026-91119Discourse is an open-source discussion platform. Prior to 20…6.4
• CVE-2026-9112Use after free in GPU in Google Chrome on Windows prior to 1…8.8
• CVE-2026-91120Discourse is an open-source discussion platform. Prior to 20…5.4
• CVE-2026-91122Discourse is an open-source discussion platform. Prior to 20…8.7
• CVE-2026-91123Discourse is an open-source discussion platform. Prior to 20…7.2
• CVE-2026-91127File Viewer is a browser-native viewer for Office, PDF, CAD,…8.2
• CVE-2026-91129Home Assistant is open source home automation software focus…5.4
• CVE-2026-9113Out of bounds read in GPU in Google Chrome on Mac prior to 1…4.3
• CVE-2026-91130Home Assistant is open source home automation software focus…9.3