A stored XSS vulnerability in the Discourse video placeholder component allows authenticated users to execute malicious scripts in the sessions of other users, posing a high risk of account takeover.

This is a stored Cross-site Scripting (CWE-79) vulnerability triggered by improper sanitization of video placeholders. An authenticated user with standard posting privileges can inject malicious JavaScript that executes when a victim interacts with the video overlay, potentially bypassing CSP restrictions if they are misconfigured.

Successful exploitation could lead to unauthorized actions performed on behalf of legitimate users, including administrative accounts. Given the CVSS score of 8.7, this is a high-severity risk that could result in the theft of session tokens, sensitive data exfiltration, or complete compromise of user accounts within the platform.

Immediate Action: Update Discourse instances to versions 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0, depending on the current branch, to ensure the patch is applied.

Proactive Monitoring: Review application access logs for unusual JavaScript errors or suspicious patterns in user-generated content, specifically around post rendering.

Compensating Controls: Ensure strict Content Security Policy (CSP) headers are enabled and enforced, as these act as a critical defense-in-depth measure against inline script execution.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to platform integrity and user security. Administrators should prioritize the deployment of the provided patches immediately. If an immediate update is not feasible, restrict the ability of untrusted users to post video content as a temporary containment measure.