PT-2026-26341 · Discourse · Discourse

Davidtaylorhq · CVE-2026-27166 · Publicado 2026-03-19 · Atualizado 2026-03-27

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2

Description Discourse is an open source discussion platform. Insufficient cleanup in the default Codepen allowed iframes value enables an attacker to manipulate a user into changing the URL of the main page. The issue involves the handling of iframes within the Codepen functionality.

Recommendations Versions prior to 2026.3.0-latest.1: Remove Codepen from the list of allowed iframes. Versions prior to 2026.2.1: Remove Codepen from the list of allowed iframes. Versions prior to 2026.1.2: Remove Codepen from the list of allowed iframes.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-80

Identificadores relacionados

BIT-DISCOURSE-2026-27166

CVE-2026-27166

GHSA-H653-CQ78-VJJ2

Produtos afetados

Discourse

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27166.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-h653-cq78-vjj2 · Aviso do Fabricante
• https://github.com/discourse/discourse/commit/c4762a4fac2f61f52f325396b11d3aeb955ea925 · Correção
• https://twitter.com/VulmonFeeds/status/2034815970468905280 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2035992548519338300 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-27166 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-27166 · Nota de Segurança
• https://twitter.com/infoflowcloud/status/2035994061757112499 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-discourse-2026-27166 · Aviso do Fabricante