PT-2026-26341 · Discourse · Discourse

Davidtaylorhq · CVE-2026-27166 · Published 2026-03-19 · Updated 2026-03-27

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2

Description Discourse is an open source discussion platform. Insufficient cleanup in the default Codepen allowed iframes value enables an attacker to manipulate a user into changing the URL of the main page. The issue involves the handling of iframes within the Codepen functionality.

Recommendations Versions prior to 2026.3.0-latest.1: Remove Codepen from the list of allowed iframes. Versions prior to 2026.2.1: Remove Codepen from the list of allowed iframes. Versions prior to 2026.1.2: Remove Codepen from the list of allowed iframes.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

BIT-DISCOURSE-2026-27166

CVE-2026-27166

GHSA-H653-CQ78-VJJ2

Affected Products

Discourse

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27166.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-h653-cq78-vjj2 · Vendor Advisory
• https://github.com/discourse/discourse/commit/c4762a4fac2f61f52f325396b11d3aeb955ea925 · Patch
• https://osv.dev/vulnerability/CVE-2026-27166 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27166 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2026-27166 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2034815970468905280 · Twitter Post
• https://twitter.com/CVEnew/status/2035992548519338300 · Twitter Post
• https://twitter.com/infoflowcloud/status/2035994061757112499 · Twitter Post