CVE-2026-72720

Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and...

CVE-2026-72720

CVE-2026-72720 affects the Discourse open‑source forum platform. The issue is an HTML injection vulnerability in PrettyText.format_for_email where cooked attribute values are reparsed as markup, enabling decoded attribute text from crafted Vimeo iframe sources, secure-upload URLs or dimensions, a...