Discourse has XSS when editing a malicious post (CVE-2026-27154)

Résumé

Discourse has XSS when editing a malicious post

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, a user full name can be evaluated as raw HTML when the following settings are set: display_name_on_posts => true; and prioritize_username_in_ux => false. Editing a post of a malicious user would trigger an XSS. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

Bitnami discourse

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2025.12.2"},{"introduced":"2026.1.0"},{"fixed":"2026.1.1"}]}]

Références

advisory github.com
web nvd.nist.gov