CVE-2026-91121

The Discourse open-source discussion platform is vulnerable to trusted-HTML injection in versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 . The root cause is that attacker-controlled upload filenames used in chat message excerpts are rendered as unescaped HTML . An attacker capable of...