Discourse PrettyText HTML Injection Vulnerability Advisory (CVE-2026-72720)

Vulnerability Overview Title: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing Description: Fixed an HTML injection issue in caused by parsing cooked attribute values as markup. When constructing Vimeo anchors and secure-upload notifications, Nokogiri node APIs are used so that decoded attribute text is not reinterpreted as HTML. The host and path of Vimeo iframes are validated to prevent non-Vimeo allowlisted iframes from being incorrectly converted. The same side-pattern is applied to the hashtag-to-plaintext replacement, and secure-upload dimensions are constrained to numeric values. Affected Versions Affected Versions: >= 2026.7.0-latest >= 2026.6.0-latest >= 2026.1.0-latest Remediation Fixed Versions: 2026.8.0-latest.1 2026.7.1 2026.6.2 2026.1.7 Patch: Upgrade to a fixed version. Workaround: Upgrade to a fixed version. Severity CVSS v3 Base Metrics: Attack vector: Network Attack complexity: Low Privileges required: Low User interaction: None Scope: Changed Confidentiality: Low Integrity: Low Availability: None CVSS: 3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVE ID CVE ID: CVE-2026-72720 Weaknesses Weaknesses: No CWEs Additional Information Moderator: danidiazfohq Published: GHSA-3qf6-6gn9-m35v Jul 31, 2026 Software: Discourse Affected versions: >= 0 >= 2026.7.0-latest >= 2026.6.0-latest >= 2026.1.0-latest Patched versions: 2026.8.0-latest.1 2026.7.1 2026.6.2 2026.1.7 Description: Impact: Fixed an HTML injection issue in caused by parsing cooked attribute values as markup. Patches: Upgrade to a fixed version. Workarounds: Upgrade to a fixed version. Severity: Moderate CVSS v3 Base Metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: Low - User interaction: None - Scope: Changed - Confidentiality: Low - Integrity: Low - Availability: None - CVSS: 3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVE ID: CVE-2026-72720 Weaknesses: No CWEs Footer: © 2026 GitHub, Inc. Footer navigation: - Terms - Privacy - Security - Status - Community - Docs - Contact - Manage cookies - Do not share my personal information

Goal Reached Thanks to every supporter — we hit 100%!

Discourse PrettyText HTML Injection Vulnerability Advisory (CVE-2026-72720)

More from this source