CVE-2026-27166 - Discourse vulnerable to HTML injection via prohibited iframe URLs

Back Back to CVE browser

MEDIUM

Discourse vulnerable to HTML injection via prohibited iframe URLs

Published Mar 19, 2026

5.4

MEDIUM

CVSS 3.1

EPSS 0.26%

Description

Discourse is an open source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2, insufficient cleanup in the default Codepen allowed iframes value allows an attacker to trick a user into changing the URL of the main page. This issue has been fixed in versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2. To workaround this issue, remove Codepen from the list of allowed iframes.

Affected products

Vendor Discourse Product Discourse Default
n/a
- Version
  < 2026.3.0-latest.1
  Status
  affected
  Constraints
  -
- Version
  >= 2026.1.0-latest, < 2026.1.2
  Status
  affected
  Constraints
  -
- Version
  >= 2026.2.0-latest, < 2026.2.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Discourse

n/a

Version	Status	Constraints
< 2026.3.0-latest.1	affected	-
>= 2026.1.0-latest, < 2026.1.2	affected	-
>= 2026.2.0-latest, < 2026.2.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-80

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-13187
Advisory
https://github.com/discourse/discourse/commit/c4762a4fac2f61f52f325396b11d3aeb955ea925
x_refsource_MISCPatch
https://github.com/discourse/discourse/security/advisories/GHSA-h653-cq78-vjj2
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-13187		Advisory
https://github.com/discourse/discourse/commit/c4762a4fac2f61f52f325396b11d3aeb955ea925		x_refsource_MISCPatch
https://github.com/discourse/discourse/security/advisories/GHSA-h653-cq78-vjj2		x_refsource_CONFIRMVendor Advisory