CVE-2026-72729

LowCVSS 2.0

Published: 10/08/2026(UTC)Updated: 11/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

A vulnerability in Discourse prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The discourse-local-dates plugin rendered crafted local-date format data as HTML on sites with a modified or disabled default Content Security Policy.

Risk Assessment

Potential HTML or JavaScript injection, which may lead to XSS attacks and session hijacking.

Recommendation

Update Discourse to one of the versions: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0.

Original NVD description (English source)

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse-local-dates plugin rendered crafted local-date format data as HTML on sites with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.