{"id":"CVE-2026-59830","title":"Discourse is an open-source discussion platform","summary":"Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a cra…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"discourse","product":"discourse","affected":["discourse < 2026.7.0"],"published":"2026-09-21","updated":"2026-09-23","sourceUpdated":"2026-09-23T17:17:50.143","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59830","references":[{"url":"https://github.com/discourse/discourse/commit/dd786594ddd088657a7e6f9fefba5bd889965fe4","label":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/releases/tag/v2026.7.0","label":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-x6mf-p7cg-69rw","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"epss":0.00165,"epssPercentile":0.06203,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-22T14:12:11.883033Z"},"ingestedAt":"2026-09-21T21:53:57.430Z","slug":"CVE-2026-59830","body":"## Overview\n\nDiscourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action descriptions. Viewing the affected user activity streams could execute attacker-controlled script in another user's browser. This issue is fixed in version 2026.7.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}