CVE-2026-91121Published
Discourse: Chat upload filenames rendered as raw HTML in excerpts
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-91121 · Microsoft / collected KEV context
cve-program · CVE-2026-91121
- https://github.com/discourse/discourse/security/advisories/GHSA-34rh-wjfv-65gq
- https://github.com/discourse/discourse/pull/42882
- https://github.com/discourse/discourse/commit/24cd7cc4c868f20e6037d67d801d60c3e289b278
- https://github.com/discourse/discourse/commit/6e7a181909c34a059d2b0a6291335a363205b787
- https://github.com/discourse/discourse/commit/9d6f5e64a1cb68e8208520e4209b361e14f7394b
- https://github.com/discourse/discourse/commit/af197941f7613a3845cba21d217641c77c8ef836
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.