CVE-2026-91120Published
Discourse: Stored HTML injection in video notification emails
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-91120 · Microsoft / collected KEV context
cve-program · CVE-2026-91120
- https://github.com/discourse/discourse/security/advisories/GHSA-h7cg-2vww-m45c
- https://github.com/discourse/discourse/pull/42882
- https://github.com/discourse/discourse/commit/6bf1cdcb3ae1aa146e1fd953a62046bf4a1f143f
- https://github.com/discourse/discourse/commit/8338919df4ecbd0fb85314b762772cc033b764e3
- https://github.com/discourse/discourse/commit/e7de8285203a2edf85beff3b951e66aeb7e5dc76
- https://github.com/discourse/discourse/commit/ed8b47df80bcc9f0bd70773fc399c9386f9d52dd
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.