CVE-2026-55674

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0

Description An unauthenticated attacker can inject arbitrary HTML into a page by sending a request containing a crafted color scheme id or dark scheme id cookie. The issue occurs because the cookie value is rendered into a color scheme tag without proper escaping, allowing the attacker to bypass the nonce-based Content Security Policy (a security layer that helps detect and block certain types of code injection attacks) and execute arbitrary JavaScript in the browsers of visitors.

Recommendations Update to version 2026.1.6 Update to version 2026.5.2 Update to version 2026.6.1 Update to version 2026.7.0