CVE-2026-91120

Executive Summary

CVE-2026-91120 is a stored cross-site scripting (XSS) vulnerability in Discourse, an open-source discussion platform. Prior to versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles within lazy video embeds (YouTube, Vimeo, TikTok) were reparsed as HTML when Discourse generated notification emails or chat summaries. Any user with standard posting privileges could embed a video whose title contained malicious markup, resulting in HTML injection into outbound emails and chat summaries.

Technical Analysis

The root cause of CVE-2026-91120 is a failure to enforce output encoding when rendering provider-supplied metadata (video titles) into an HTML context. Discourse's lazy video embed feature fetches metadata — including the title — from supported third-party video providers (YouTube, Vimeo, TikTok). When composing notification emails and chat summaries, the application placed these provider-controlled titles into the HTML body without properly treating them as untrusted text.

Because the rendering pipeline reparsed these titles as HTML, any markup present in a video title would be interpreted by the receiving email client rather than displayed literally. This is a classic stored cross-site scripting (CWE-79) condition, though its delivery vector is unconventional: the injected markup is not served in the Discourse forum page itself (the advisory explicitly notes the forum page was not affected), but is embedded into notification emails and chat summaries delivered to other users.

Two preconditions apply. First, lazy video embeds must be enabled — this is the default configuration, so most deployments are exposed. Second, the attacker only needs standard posting privileges, meaning no elevated role or administrative access is required. The attack surface is therefore the post-creation path combined with the email/chat-summary rendering pipeline.

The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4) reflects: network-reachable, low attack complexity, low privileges required, no user interaction required for the vulnerable path to execute, and a scope that remains unchanged. Confidentiality and integrity impacts are both Low, and there is no availability impact. The scope-unchanged rating is consistent with the advisory's statement that the issue did not directly expose a Discourse browser session.

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-91120, and the vendor advisory does not publish a payload. The following chain is inferred strictly from the vulnerability class and the described mechanism.

1. Reconnaissance / target identification: An attacker identifies a Discourse instance running a version prior to 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0, and confirms that lazy video embeds are enabled (the default). A low-privileged account with standard posting rights is obtained or registered.

2. Triggering the flaw: The attacker creates a post containing a lazy video embed for an enabled provider — YouTube, Vimeo, or TikTok — where the video's title field contains HTML markup. Because the title is provider-controlled and the embed is lazy, Discourse ingests the title during rendering.

3. Payload execution path: When Discourse generates notification emails or chat summaries, the rendering path reparses the provider-supplied title as HTML rather than treating it solely as text. The injected markup is therefore placed into the email or chat-summary output. Per the advisory, injected content could include event handlers.

4. Post-exploitation impact: Recipients using HTML-capable email clients could see the injected content, potentially including event handlers. The advisory explicitly states that the issue did not directly expose a Discourse browser session and did not affect the forum page itself, so the primary impact is confined to the email/chat-summary rendering context rather than the Discourse web session.

Impact Assessment

CVE-2026-91120 carries a CVSS base score of 5.4 (Medium), with Confidentiality Low and Integrity Low subscores and no Availability impact. The attack requires only standard posting privileges (PR:L) and network access (AV:N), with low complexity (AC:L) and no user interaction required for the vulnerable path (UI:N).

Business impact centers on trust and integrity of outbound communications: notification emails and chat summaries generated by the platform can carry attacker-controlled HTML or event handlers into recipients' mail clients. Because the advisory states the forum page itself and Discourse browser sessions were not directly exposed, the blast radius is bounded to the email and chat-summary rendering surfaces. However, in environments where HTML-capable email clients render such content, recipients may be exposed to injected markup, which can facilitate downstream phishing or credential-harvesting lures attributed to a trusted platform. Affected systems are all Discourse deployments with lazy video embeds enabled (the default) that have not yet upgraded to a fixed release.

Detection Guidance

Sigma Rule

title: Discourse Lazy Video Embed Title HTML Injection in Email/Chat Summaries
id: 7f3c9a12-4b8e-4d2a-9c31-6e5b1d8f0a44
status: experimental
description: Detects HTML markup present in provider-controlled video titles embedded in Discourse posts, consistent with CVE-2026-91120 stored XSS via lazy video embeds.
logsource:
  product: discourse
  service: application
detection:
  selection_provider:
    message|contains:
      - 'youtube.com'
      - 'youtu.be'
      - 'vimeo.com'
      - 'tiktok.com'
  selection_markup:
    message|contains:
      - '<script'
      - 'onerror='
      - 'onload='
      - 'onmouseover='
      - '<img'
      - '<svg'
      - 'javascript:'
  condition: selection_provider and selection_markup
falsepositives:
  - Legitimate video titles containing angle brackets or the word javascript
level: medium
tags:
  - attack.t1059.007
  - cve.2026.91120

YARA Rule

rule CVE_2026_91120_Discourse_Lazy_Video_Title_XSS
{
    meta:
        description = "Detects provider-controlled video titles containing HTML markup consistent with CVE-2026-91120 (Discourse lazy video embed XSS via email/chat summaries)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91120"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $p1 = "youtube.com" ascii nocase
        $p2 = "youtu.be" ascii nocase
        $p3 = "vimeo.com" ascii nocase
        $p4 = "tiktok.com" ascii nocase

        $m1 = "<script" ascii nocase
        $m2 = "onerror=" ascii nocase
        $m3 = "onload=" ascii nocase
        $m4 = "onmouseover=" ascii nocase
        $m5 = "javascript:" ascii nocase

    condition:
        any of ($p*) and any of ($m*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91120 Discourse Lazy Video Embed Title HTML Injection Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/posts"; http.request_body; content:"youtube.com"; nocase; http.request_body; pcre:"/<script|onerror=|onload=|onmouseover=|javascript:/i"; classtype:web-application-attack; reference:cve,2026-91120; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91120; sid:202691120; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [any where event.category == "web" and url.path == "/posts" and
     wildcard(http.request.body, "*youtube.com*") or
     wildcard(http.request.body, "*vimeo.com*") or
     wildcard(http.request.body, "*tiktok.com*")]
  [any where wildcard(message, "*<script*") or
     wildcard(message, "*onerror=*") or
     wildcard(message, "*onload=*")]

Splunk SPL Query

index=discourse sourcetype=discourse:app
| eval body=coalesce(request_body, message, raw)
| where (match(body, "(?i)youtube\\.com|youtu\\.be|vimeo\\.com|tiktok\\.com"))
    AND (match(body, "(?i)<script|onerror=|onload=|onmouseover=|javascript:"))
| stats count values(user) as users values(src_ip) as source_ips by body
| sort - count

Wazuh OSSEC Rule

<group name="discourse,web,attack,">
  <rule id="2026911" level="10">
    <decoded_as>json</decoded_as>
    <field name="message">youtube\.com|youtu\.be|vimeo\.com|tiktok\.com</field>
    <regex type="pcre2">(?i)<script|onerror=|onload=|onmouseover=|javascript:</regex>
    <description>CVE-2026-91120: Possible Discourse lazy video embed HTML injection via provider-controlled title</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_91120,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor advisory states the issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0; however, no tracked source has confirmed patch evidence in this dataset, so treat remediation as unverified and validate against the vendor's official release notes.

1. Immediate mitigations:

   • Disable lazy video embeds if operationally feasible; note this is non-default and will reduce functionality. This removes the vulnerable title-ingestion path.
   • Restrict posting privileges for untrusted users where possible, reducing the pool of accounts able to create embeds.
   • Apply aggressive HTML sanitization or plain-text-only rendering to notification emails and chat summaries at the mail gateway/DLP layer for platform-generated messages.

2. Patch/upgrade steps:

   • Upgrade to one of the fixed releases: 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0, choosing the appropriate branch for your deployment.
   • Confirm version post-upgrade and verify lazy video embed behavior in a staging environment before production rollout.
   • Because the patch is unverified in this dataset, cross-reference the official Discourse release notes prior to relying solely on the version upgrade.

3. Long-term hardening:

   • Enforce contextual output encoding for all provider-supplied metadata (titles, descriptions, author names) as untrusted text, never as HTML.
   • Adopt a strict Content Security Policy for generated email and chat-summary content where the rendering context supports it.
   • Treat third-party provider metadata as hostile input and sanitize at the ingestion boundary rather than at the rendering boundary.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-91120
• Discourse official release notes and security advisories (versions 2026.1.8, 2026.6.3, 2026.7.2, 2026.8.0)
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') — https://cwe.mitre.org/data/definitions/79.html
• CISA KEV: Not listed (no known exploited vulnerability status as of this report)
• EPSS: Not yet scored by FIRST.org at the time of writing; no exploitation-in-the-wild evidence or threat actor campaign data is currently available for this CVE.