CVE-2026-91122

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting privileges could store the crafted placeholder in a post. When another user opened the post and clicked the video play overlay, the handler could execute arbitrary JavaScript in the viewer's session. Default Content Security Policy settings block inline event handlers, but instances with CSP disabled or relaxed could allow the script to read page content and make authenticated requests as the viewer. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

• CWE-79

• https://github.com/discourse/discourse/commit/05d92b8749f68d2626cbe65ec7adde7562a0283d
• https://github.com/discourse/discourse/commit/5674b3e6594825c28d2678e55057fd6802f11031
• https://github.com/discourse/discourse/commit/c3993e318e172389be5c98455177876f1dd87dda
• https://github.com/discourse/discourse/commit/d7126af3264b672d2201d84c18a37cb8627424a8
• https://github.com/discourse/discourse/pull/42882
• https://github.com/discourse/discourse/security/advisories/GHSA-8m44-f6g9-7cg7

Published

Sep 24, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-91106HP has identified and remediated multiple externally reporte…9.8
• CVE-2026-9111Use after free in WebRTC in Google Chrome on Linux prior to …8.8
• CVE-2026-91119Discourse is an open-source discussion platform. Prior to 20…6.4
• CVE-2026-9112Use after free in GPU in Google Chrome on Windows prior to 1…8.8
• CVE-2026-91120Discourse is an open-source discussion platform. Prior to 20…5.4
• CVE-2026-91121Discourse is an open-source discussion platform. Prior to 20…5
• CVE-2026-91123Discourse is an open-source discussion platform. Prior to 20…7.2
• CVE-2026-91127File Viewer is a browser-native viewer for Office, PDF, CAD,…8.2
• CVE-2026-91129Home Assistant is open source home automation software focus…5.4
• CVE-2026-9113Out of bounds read in GPU in Google Chrome on Mac prior to 1…4.3
• CVE-2026-91130Home Assistant is open source home automation software focus…9.3
• CVE-2026-91132Discourse is an open-source discussion platform. Prior to 20…4.3