VULNERABILITY INTELLIGENCE

CVE-2026-72729

EPSS probability0.48%
CISA KEVNot currently listed
Published2026-08-10
Last modified2026-09-08

Description

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse-local-dates plugin rendered crafted local-date format data as HTML on sites with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Weakness classification

  • security-advisories@github.com: CWE-79

Primary references