CVE-2026-91122

Executive Summary

CVE-2026-91122 is a stored cross-site scripting (XSS) vulnerability in Discourse, an open-source discussion platform. The flaw resides in the video placeholder component, which permits crafted HTML to break out of an attribute context and inject an attacker-controlled event handler. Any authenticated user with default trust-level posting privileges can store the malicious placeholder in a post; when a victim opens that post and clicks the video play overlay, the injected handler executes arbitrary JavaScript in the victim's session. Instances running with Content Security Policy (CSP) disabled or relaxed are at highest risk, as the injected script can then read page content and issue authenticated requests on behalf of the viewer.

Technical Analysis

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., cross-site scripting). Per the NVD description, the affected surface is the video placeholder component within Discourse. The core defect is an attribute breakout: user-supplied content embedded into the placeholder is not correctly contextualized or escaped for the HTML attribute in which it is placed. By supplying crafted HTML, an attacker can prematurely terminate the attribute value and append their own event handler attribute (for example, a handler that fires on a user interaction).

The attack is gated by two conditions described by the vendor:

1. Posting privilege: The attacker must be an authenticated user holding default trust-level posting privileges. This is a relatively low bar — no administrative role is required.
2. User interaction: The injected handler is designed to fire when a victim opens the affected post and clicks the video play overlay. This is consistent with the CVSS vector, which specifies UI:R (User Interaction: Required).

A critical mitigating control is Content Security Policy. The description explicitly states that default CSP settings block inline event handlers. This means exploitation producing real JavaScript execution depends on the instance having CSP disabled or relaxed. Where CSP is relaxed, the injected handler can execute arbitrary JavaScript in the viewer's session, enabling the script to read page content and make authenticated requests as the victim — consistent with the CVSS environmental scope change (S:C) and High confidentiality and integrity impacts (C:H/I:H). Availability impact is rated A:N (None).

No specific function names, parameter names, or URL endpoints are provided in the source description; the analysis above stays at the vulnerability-class and component level. The CWE mapping (CWE-79) is authoritative and confirms the stored/reflected XSS class.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-91122. The following attack chain is inferred from the vulnerability class and the vendor description — it does not assert specific code patterns or named functions beyond what the NVD text provides.

1. Reconnaissance / target identification: An attacker identifies internet- or intranet-exposed Discourse instances by fingerprinting the platform. Public Shodan-style queries (e.g., page titles containing "Discourse" or HTML/component fingerprints) identify candidate targets. The attacker also seeks to determine whether the instance has CSP disabled or relaxed, since that condition elevates the flaw from blocked to exploitable.

2. Prerequisite access / trigger of the flaw class: The attacker registers or obtains an authenticated account and, using default trust-level posting privileges, authors a post containing the crafted video placeholder. The crafted HTML is designed to break out of the attribute context of the video placeholder component and inject an attacker-controlled event handler. This is the storage stage of a stored XSS: the malicious markup is persisted in the post.

3. Payload / execution method (class level): A victim later opens the affected post and clicks the video play overlay. The interaction fires the injected event handler. On instances with default CSP, inline event handlers are blocked and the handler does not execute; on instances with CSP disabled or relaxed, the handler executes arbitrary JavaScript in the viewer's session.

4. Post-exploitation impact: Because the script runs in the victim's authenticated session, it can read page content and make authenticated requests as the viewer. Depending on the viewer's privileges (regular user through administrator), this can enable session-context actions, data exfiltration of visible content, and state-changing requests — matching the High confidentiality and integrity impact in the CVSS vector. Availability is not impacted.

Impact Assessment

The CVSS 3.1 base vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, yielding a base score of 8.7 (High).

• Attack Vector (AV:N — Network): Exploitable remotely over the network via the Discourse web interface.
• Attack Complexity (AC:L — Low): No specialized conditions beyond the described prerequisites; the crafted content is deterministic.
• Privileges Required (PR:L — Low): The attacker needs an authenticated account with default trust-level posting privileges — not administrative access.
• User Interaction (UI:R — Required): A victim must open the post and click the video play overlay.
• Scope (S:C — Changed): The vulnerable component's security context is impacted beyond its own scope; the injected script executes in the viewer's session context.
• Confidentiality (C:H): The script can read page content in the victim's session, including potentially sensitive material visible to that user.
• Integrity (I:H): The script can make authenticated requests as the viewer, enabling state-changing actions within the victim's authority.
• Availability (A:N): No availability impact.

Business impact: Discourse is widely deployed for community forums, customer support portals, and internal collaboration. A stored XSS in a community platform can compromise the authenticated sessions of regular users and, critically, of moderators and administrators who view the affected post. Where CSP is relaxed, the blast radius includes any viewer of the poisoned post across the instance's user base. The changed scope and High C/I ratings make this a priority remediation for internet-exposed community deployments.

Detection Guidance

Sigma Rule

title: Suspicious Event Handler Injection in Discourse Video Placeholder
id: 9c1f4b2a-7d3e-4f10-9a2b-5e6c8d1f0a3c
status: experimental
description: Detects requests or log entries consistent with attribute-breakout event-handler injection targeting the Discourse video placeholder component (CVE-2026-91122).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91122
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
  selection_body:
    cs-body|contains:
      - 'onclick='
      - 'onmouseover='
      - 'onload='
      - 'onerror='
      - '<video'
      - 'placeholder'
  selection_breakout:
    cs-body|contains:
      - '"><'
      - "'><"
      - '&#34;><'
      - '&#39;><'
  condition: selection_method and selection_body and selection_breakout
fields:
  - c-ip
  - cs-uri-stem
  - cs-body
falsepositives:
  - Legitimate rich-text posts containing embedded media attributes
  - Editor tooling that serializes HTML attributes
level: medium
tags:
  - attack.t1190
  - cve.2026.91122

YARA Rule

rule CVE_2026_91122_Discourse_Video_Placeholder_XSS
{
    meta:
        description = "Detects attribute-breakout event-handler injection targeting the Discourse video placeholder component (CVE-2026-91122)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91122"
        date = "2026-01-01"
        cve = "CVE-2026-91122"

    strings:
        $video     = "video" nocase
        $ph        = "placeholder" nocase
        $h1        = "onclick=" nocase
        $h2        = "onmouseover=" nocase
        $h3        = "onload=" nocase
        $h4        = "onerror=" nocase
        $h5        = "onfocus=" nocase
        $brk1      = "\"><"
        $brk2      = "'><"

    condition:
        uint16(0) == 0x3C3F or filesize < 512KB
        and ($video or $ph)
        and any of ($h1, $h2, $h3, $h4, $h5)
        and any of ($brk1, $brk2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91122 Discourse Video Placeholder Stored XSS Attribute Breakout Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"video"; nocase; http.request_body; content:"placeholder"; nocase; pcre:"/(onclick|onmouseover|onload|onerror|onfocus)\s*=/i"; pcre:"/[\"']\s*>\s*</"; reference:cve,2026-91122; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91122; classtype:web-application-attack; sid:202691122; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10m
  [ http where http.request.method == "GET" and url.path : "*" ]
  [ http where http.request.method == "POST" and
      http.request.body.content : ("onclick=" or "onmouseover=" or "onload=" or "onerror=")
      and http.request.body.content : ("<video" or "placeholder") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=discourse
| eval body=coalesce(post_data, request_body, cs_body)
| where (match(body, "(?i)on(click|mouseover|load|error|focus)\s*=") AND match(body, "(?i)(<video|placeholder)"))
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths by src_ip, user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="discourse,web,xss,">
  <rule id="2026911" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.request.body.content">on(click|mouseover|load|error|focus)=</field>
    <description>CVE-2026-91122: Possible attribute-breakout event handler injection in Discourse video placeholder</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_91122,</group>
  </rule>
  <rule id="2026912" level="12">
    <if_sid>2026911</if_sid>
    <field name="http.request.body.content">(&quot;&gt;&lt;|&#39;&gt;&lt;|&apos;&gt;&lt;)</field>
    <description>CVE-2026-91122: Confirmed attribute breakout pattern in Discourse video placeholder post</description>
    <group>cve_2026_91122,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Per the vendor description, the issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

1. Immediate mitigations (until upgrade is applied):

• Do not disable or relax Content Security Policy. The default CSP blocks inline event handlers and is the primary control that renders this flaw non-executable on default configurations. Verify that CSP is enabled and enforced on all Discourse instances.
• Restrict registration and posting privileges where operationally feasible, reducing the pool of accounts capable of storing crafted content at default trust levels.
• Enable moderation/approval workflows for new or low-trust users so crafted posts are reviewed before publication.
• Monitor for suspicious video placeholder content (see detection guidance) and quarantine/remove offending posts.

2. Patch / upgrade steps:

• Upgrade to any of the fixed releases: 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0, selecting the version line appropriate to your deployment branch.
• Apply the upgrade on an out-of-band maintenance window; validate post-upgrade that the video placeholder component no longer permits attribute breakout.
• Confirm CSP remains enabled after the upgrade to preserve defense-in-depth.

3. Long-term hardening:

• Treat CSP as a mandatory, enforced control rather than optional; audit for and eliminate any instance with CSP disabled or relaxed.
• Adopt contextual output encoding for all user-supplied content embedded in HTML attributes, and enforce it through code review and automated testing.
• Keep Discourse updated; subscribe to vendor security advisories for timely fix notifications.
• Conduct periodic authenticated-user XSS testing against media/embed components.

References

• NVD — CVE-2026-91122: https://nvd.nist.gov/vuln/detail/CVE-2026-91122
• MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• Discourse project (vendor) — official release/security announcements: https://meta.discourse.org/
• FIRST EPSS — scoring model (no EPSS value assigned to CVE-2026-91122 at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities catalog — CVE-2026-91122 not currently listed: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild / threat actor evidence: None. No public PoC, exploit code, Nuclei template, or KEV listing exists for CVE-2026-91122 as of this report. No known threat actor campaigns are associated with this CVE. Exploitation at scale requires a target instance with relaxed or disabled CSP.