CVE-2026-55424CWE-79

Discourse: Topic featured link susceptible to stored XSS

High · published July 9, 2026

CVSS v4.0
7.4
EPSS
0%
Percentile
34.7
In the wild
Unconfirmed
What it is

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic "featured link" was not sufficiently normalized and escaped before being rendered in the topic list, allowing a user who can set a featured link to inject JavaScript when default Content Security Policy protections were modified or disabled. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

The record
Technical detail
CVSS v4.0
7.4 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00415 · 34.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-09T22:01Z
EPSS history
Timeline
  • 09 JUL 22:01Z
    Discourse: Topic featured link susceptible to stored XSS
    cvelistv5