Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-91159— Discourse: Stored oEmbed HTML injection via allowed iframe

Quick assessment

Affected
discourse discourse
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Discourse 是一个开源的讨论平台。在版本 2026.9.0、2026.8.1、2026.7.3 和 2026.1.9 之前，oEmbed 处理机制存在安全漏洞：当 HTML 片段中包含一个其源（src）与配置允许列表匹配的 iframe 时，系统会将整个由攻击者控制的 HTML 片段视为可信内容。拥有发帖权限且能控制公共网页及其 oEmbed 响应的用户，可以将允许列表中的 iframe 与无关的兄弟 HTML 或 CSS 元素组合，导致在帖子内容中出现存储型视觉覆盖层或其他样式化内容，从而可能呈现误导性或

CVSS 7.7 · High EPSS 0.43% · P36

Affected Version Matrix 4

VendorProduct Version RangeStatus
discourse discourse < 2026.1.9 affected
>= 2026.7.0-latest, < 2026.7.3 affected
>= 2026.8.0-latest, < 2026.8.1 affected
>= 2026.9.0-latest, < 2026.9.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-91159

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Discourse: Stored oEmbed HTML injection via allowed iframe
Source: CVE Program / CVE List V5
Vulnerability Description
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permission who controlled a public webpage and its oEmbed response could combine an allowlisted iframe with unrelated sibling HTML or CSS, causing stored visual overlays or other styled content to appear in post content and enabling misleading or fraudulent user interfaces. Exploitation requires a posting account, control of the fetched webpage and oEmbed response, and an allowlisted iframe source. The issue affects content integrity but does not expose restricted data, disrupt availability, or require interaction with Discourse Content Security Policy. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
discourse discourse < 2026.1.9 -

II. Public POCs for CVE-2026-91159

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-91159

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-91159 (4)

Other References for CVE-2026-91159 (1)

Same Patch Batch · discourse · 2026-10-14 · 3 CVEs total

CVE-2026-91156 7.5 HIGH Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
CVE-2026-91157 7.5 HIGH Discourse: Media uploads remain publicly accessible after category permissions are restric

IV. Related Vulnerabilities

Same product: discourse
Same vendor: discourse
Same weakness: CWE-79

V. Comments for CVE-2026-91159

No comments yet

Leave a comment