CVE-2026-91119

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-91119
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91119.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-91119
Aliases
  • GHSA-pv3p-p3m9-v8v3
Published
2026-09-24T17:07:04Z
Modified
2026-09-26T03:48:38Z
Severity
  • 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Discourse: Encode action_code_who in mention URLs
Details

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form action_code_who value into mention-link href attributes without URL encoding. A quote-bearing display name could terminate the intended URL attribute and inject attacker-controlled elements into the trusted rendered markup. Although the visible mention text was escaped, the unencoded path component allowed stored HTML injection when another user viewed the affected topic action or activity log. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91119.json"
}
References

Affected packages

Git / github.com/discourse/discourse

Affected ranges

Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
ded677e00beb0e9bae6e70b69582aecfb72b5477
Introduced
06d03da34c4ed09ea59f917f045ba250d2b6320d
Introduced
322d3c0ac6a8f133b3f82875e9dbbe310f638c1b
Fixed
fb9247e04a826ab8e4d91168b3c4c839ec40bccc
Fixed
3ab62a8397926ed934b667a5db06284c45b4c774
Fixed
777cb880553b517bc9ae502e935a160332e48b78
Fixed
e808d0853e013abf90e648e53ebd606c49ccb19f
Fixed
20dbf112760eb1d6a58f2e49aeef7546898b6f1c
Fixed
66653c484cfb91bc346f9a326f6945387f17b035
Fixed
77a81c7a3a7ff9e94b355e32b8f379f2d389e05a
Fixed
c4748f651d9d2f3a6dd3106a4d5564536c645168
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2026.8.0"
        },
        {
            "introduced":  "2026.7.0-latest"
        },
        {
            "fixed":  "2026.7.2"
        },
        {
            "introduced":  "2026.6.0-latest"
        },
        {
            "fixed":  "2026.6.3"
        },
        {
            "introduced":  "2026.1.0-latest"
        },
        {
            "fixed":  "2026.1.8"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

Other
_gh-attach-assets
esr
stable
v2026.*
v2026.1.0
v2026.1.0-latest
v2026.1.1
v2026.1.2
v2026.1.3
v2026.1.4
v2026.1.5
v2026.1.6
v2026.1.7
v2026.6.0
v2026.6.0-latest
v2026.6.1
v2026.6.2
v2026.7.0
v2026.7.0-latest
v2026.7.1
v2026.8.0-latest
v2026.8.0-latest.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91119.json"