CVE-2026-72729 Discourse is an open-source discussion platform. Prior… — CVE Notify

CVE Notify@cveNotify · 19.7K subscribers Open in TelegramOpen

🚨 CVE-2026-72729
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse-local-dates plugin rendered crafted local-date format data as HTML on sites with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

🎖@cveNotify

GitHub

SECURITY: Prevent HTML injection in discourse-local-dates rendering [… · discourse/discourse@9768f47

…backport 2026.1]

t.me/cveNotify/291794

September 8, 2026 2