A critical cross-site scripting vulnerability in Discourse allows unauthenticated attackers to execute arbitrary JavaScript in user browsers, bypassing Content Security Policy protections.

This is a cross-site scripting vulnerability (CWE-79). An unauthenticated attacker can inject arbitrary HTML via crafted color scheme cookies, which executes JavaScript by bypassing the application nonce-based Content Security Policy.

Successful exploitation allows attackers to perform actions on behalf of authenticated users, steal session cookies, or redirect users to malicious sites. This can lead to account hijacking and the compromise of sensitive communications within the forum. The CVSS score of 9.3 reflects the significant risk to user privacy and session integrity.

Immediate Action: Upgrade Discourse to versions 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 as appropriate for your deployment branch.

Proactive Monitoring: Monitor for unusual cookie values in web traffic and report any suspicious client-side script execution observed by users.

Compensating Controls: Ensure that strict browser-level security policies are enforced and consider temporary WAF rules to block requests containing anomalous cookie parameters.

Public Exploit Available: Unknown

Given the ability to bypass security policies, this vulnerability poses a severe risk to all Discourse users. Organizations must apply the provided updates immediately to restore the integrity of the platform's security controls.