CVE-2026-91134

The open-source discussion platform Discourse contains a vulnerability in its post sanitizer prior to versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 . The root cause is a logic flaw where the sanitizer validates a decoded form of an iframe src differently than how the browser interprets it. ...