CVE-2026-72720

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.7 Discourse versions prior to 2026.6.2 Discourse versions prior to 2026.7.1 Discourse versions prior to 2026.8.0-latest.1

Description An HTML injection issue exists in the PrettyText.format for email() function. This occurs because cooked attribute values are reparsed as markup, allowing decoded attribute text to be reinterpreted as HTML. Specifically, crafted Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag data-slug values can trigger this behavior. Additionally, the conversion process fails to strictly validate the Vimeo iframe host and path, which allows the conversion of iframes that are not on the Vimeo allowlist.

Recommendations Update to version 2026.1.7. Update to version 2026.6.2. Update to version 2026.7.1. Update to version 2026.8.0-latest.1.