CVE-2026-27166

Published: Mar 19, 2026 Last Modified: Mar 19, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 4,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: required
Scope: changed
Confidentiality: none
Integrity: low
Availability: none

Description

AI Translation Available

Discourse is an open source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2, insufficient cleanup in the default Codepen allowed iframes value allows an attacker to trick a user into changing the URL of the main page. This issue has been fixed in versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2. To workaround this issue, remove Codepen from the list of allowed iframes.

80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Incomplete
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability
Potential Impacts:
Read Application Data Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies: Web Based, Web Server
Likelihood of Exploit: High
View CWE Details
https://github.com/discourse/discourse/commit/c4762a4fac2f6…
https://github.com/discourse/discourse/commit/c4762a4fac2f61f52f325396b11d3aeb9…
https://github.com/discourse/discourse/security/advisories/…
https://github.com/discourse/discourse/security/advisories/GHSA-h653-cq78-vjj2