CVE-2026-91134Published
Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-91134 · Microsoft / collected KEV context
cve-program · CVE-2026-91134
- https://github.com/discourse/discourse/security/advisories/GHSA-54vw-chv3-wjpv
- https://github.com/discourse/discourse/pull/42882
- https://github.com/discourse/discourse/commit/0a8015e6c7a5079981843721494d30c9a91f5415
- https://github.com/discourse/discourse/commit/1304b0c04f87534053b0d574ae5a9b9ba13dd590
- https://github.com/discourse/discourse/commit/bac7dd1201911851462483271b4567246fa1309d
- https://github.com/discourse/discourse/commit/fed3a58c48412ce7207b72a4629ddbc44482cd64
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.