CVE-2026-55424: Discourse: Topic featured link susceptible to stored XSS
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic "featured link" was not sufficiently normalized and escaped before being rendered in the topic list, allowing a user who can set a featured link to inject JavaScript when default Content Security Policy protections were modified or disabled. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55424?
The severity of CVE-2026-55424 is high, with a CVSS score of 7.4.
How do I fix CVE-2026-55424?
To fix CVE-2026-55424, update to Discourse versions 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5 or later.
What kind of vulnerability is CVE-2026-55424?
CVE-2026-55424 is a stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-55424?
Users of Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 are affected by CVE-2026-55424.
What are the consequences of CVE-2026-55424?
CVE-2026-55424 allows an attacker to inject JavaScript into the topic list if they can set a featured link.