---
id: CVE-2026-53962
title: Discourse is an open-source discussion platform
summary: >-
  Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1,
  2026.4.2, and 2026.1.5, insufficient SVG sanitization in upload and user
  avatar handling could lead to cross-site scripting when a user visited
  specific URLs t…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
published: '2026-07-09'
updated: '2026-07-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53962'
references:
  - url: >-
      https://github.com/discourse/discourse/commit/3ee8343cd7f00d59d8513bee0a12e02d50bfc358
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/commit/810c2715799fd08b06fd6ffc664d9562fe9ea6ff
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/commit/92a699d89b84685b6fdd63cd0d0e371793c69dad
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/commit/b8ceb49f4ba52257be30eb3c2ce51a5bf03be5fe
    label: security-advisories@github.com
  - url: 'https://github.com/discourse/discourse/releases/tag/v2026.1.5'
    label: security-advisories@github.com
  - url: 'https://github.com/discourse/discourse/releases/tag/v2026.4.2'
    label: security-advisories@github.com
  - url: 'https://github.com/discourse/discourse/releases/tag/v2026.5.1'
    label: security-advisories@github.com
  - url: 'https://github.com/discourse/discourse/releases/tag/v2026.6.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/security/advisories/GHSA-jmcf-3367-78vv
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00415
epssPercentile: 0.33116
ingestedAt: '2026-07-11T20:15:25.760Z'
---

## Overview

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, insufficient SVG sanitization in upload and user avatar handling could lead to cross-site scripting when a user visited specific URLs that are not normally part of community browsing. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.