Discourse Unauthenticated HTML Injection Enabling CSP Bypass
In Discourse before 2026.7.0, a crafted cookie injects arbitrary HTML and bypasses nonce-based CSP, enabling unauthenticated XSS. CVSS 9.3 critical.
- Vendor
- Discourse
- Product
- Discourse (prior to 2026.1.6, 2026.5.2, 2026.6.1, 2026.7.0)
- CVSS
- 9.3
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
CVE-2026-55674 is a critical unauthenticated HTML injection vulnerability in Discourse, the open-source community forum platform. The flaw allows a remote, unauthenticated attacker to send a single crafted request and inject arbitrary HTML — including script tags — into any Discourse page, bypassing the site’s nonce-based Content Security Policy.
The attack vector is the color_scheme_id or dark_scheme_id cookie. Discourse rendered this value into a color scheme tag without sanitizing it, allowing the value to break out of the attribute boundary and place arbitrary markup. The injected content was treated by the browser as nonce-bearing, defeating the CSP and enabling JavaScript execution in the context of the victim’s session.
Patch: Update to Discourse 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0. Standard Docker installs: ./launcher rebuild app. Verify installed version in Admin → Dashboard.
See the 0dayNews article for the full patch batch, including three additional information-disclosure CVEs fixed in the same release.
