CVE-2017-20290

The Discourse platform, versions 1.9.0.beta2 before 1.9.0.beta13 , is vulnerable to a reflected cross-site scripting (XSS) flaw. The root cause is that the unsubscribed.html.erb template renders the email parameter from the /email/unsubscribed endpoint unescaped via the html_safe method. Unauthen...