CVE-2026-27154

MEDIUM

Discourse < 2025.12.2, 2026.1.1, 2026.2.0 - Stored Cross-Site Scripting via User Full Name

Title source: llm

Description

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, a user full name can be evaluated as raw HTML when the following settings are set: `display_name_on_posts` => true; and `prioritize_username_in_ux` => false. Editing a post of a malicious user would trigger an XSS. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://github.com/discourse/discourse/security/advisories/GHSA-xv43-5gcp-wgw8

Scores

CVSS v3 6.1

EPSS 0.0005

EPSS Percentile 16.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (2)

discourse/discourse 2026.2.0

discourse/discourse < 2025.12.2

Published Feb 26, 2026

Tracked Since Feb 27, 2026