CVE-2026-91134

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-91134
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91134.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-91134
Aliases
  • GHSA-54vw-chv3-wjpv
Published
2026-09-24T16:51:34Z
Modified
2026-09-29T11:48:16Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist
Details

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowed_iframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form differently from the stored iframe src, allowing the browser to interpret an attacker-controlled host while the allowlist check accepted the encoded URL as an allowed prefix. An authenticated user with posting privileges could persist the iframe in a post and cause attacker-controlled cross-origin content to be rendered. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-20"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91134.json"
}
References

Affected packages

Git / github.com/discourse/discourse

Affected ranges

Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
fb9247e04a826ab8e4d91168b3c4c839ec40bccc
Introduced
ded677e00beb0e9bae6e70b69582aecfb72b5477
Fixed
3ab62a8397926ed934b667a5db06284c45b4c774
Introduced
06d03da34c4ed09ea59f917f045ba250d2b6320d
Fixed
777cb880553b517bc9ae502e935a160332e48b78
Introduced
322d3c0ac6a8f133b3f82875e9dbbe310f638c1b
Fixed
e808d0853e013abf90e648e53ebd606c49ccb19f
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2026.8.0"
        },
        {
            "introduced":  "2026.7.0-latest"
        },
        {
            "fixed":  "2026.7.2"
        },
        {
            "introduced":  "2026.6.0-latest"
        },
        {
            "fixed":  "2026.6.3"
        },
        {
            "introduced":  "2026.1.0-latest"
        },
        {
            "fixed":  "2026.1.8"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

Other
_gh-attach-assets
esr
stable
v2026.*
v2026.1.0
v2026.1.0-latest
v2026.1.1
v2026.1.2
v2026.1.3
v2026.1.4
v2026.1.5
v2026.1.6
v2026.1.7
v2026.6.0
v2026.6.0-latest
v2026.6.1
v2026.6.2
v2026.7.0
v2026.7.0-latest
v2026.7.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91134.json"