---
id: CVE-2026-55674
title: Discourse is an open-source discussion platform
summary: >-
  Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2,
  2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single
  request with a crafted color_scheme_id (or dark_scheme_id) cookie to inject
  arbitrary H…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N'
cwe:
  - CWE-79
published: '2026-08-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55674'
references:
  - url: >-
      https://github.com/discourse/discourse/security/advisories/GHSA-qx4v-rg4v-pm2g
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.0059
epssPercentile: 0.45918
ingestedAt: '2026-09-18T20:51:25.621Z'
---

## Overview

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted color_scheme_id (or dark_scheme_id) cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered into a color scheme tag without escaping, the attacker could break out of the attribute and inject a tag that bypassed Discourse's nonce-based Content Security Policy, resulting in arbitrary JavaScript execution in visitors' browsers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.