CVE-2026-55424

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.6.0 Discourse versions prior to 2026.5.1 Discourse versions prior to 2026.4.2 Discourse versions prior to 2026.1.5

Description A topic featured link is not sufficiently normalized and escaped before being rendered in the topic list. This allows a user with permissions to set a featured link to inject JavaScript, provided that the default Content Security Policy (CSP) protections—a security layer that helps detect and mitigate certain types of attacks, including cross-site scripting—are modified or disabled.

Recommendations Update to version 2026.6.0 Update to version 2026.5.1 Update to version 2026.4.2 Update to version 2026.1.5