{"id":"CVE-2026-72720","summary":"Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing","details":"Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.format_for_email because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag data-slug values can cause decoded attribute text to be reinterpreted as HTML. The vulnerable conversion also fails to strictly validate the Vimeo iframe host and path, allowing non-Vimeo allowlisted iframes to be converted. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.","aliases":["BIT-discourse-2026-72720","GHSA-3q6f-6gm9-m35v"],"modified":"2026-08-17T08:10:29.555933473Z","published":"2026-08-10T15:41:51.764Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72720.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-79"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72720.json"},{"type":"ADVISORY","url":"https://github.com/discourse/discourse/security/advisories/GHSA-3q6f-6gm9-m35v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72720"},{"type":"FIX","url":"https://github.com/discourse/discourse/commit/234ee88a5b9b53bf938c53351eab20130323485f"},{"type":"FIX","url":"https://github.com/discourse/discourse/commit/4b639a52f47fb3d46093bece9df147e4e9517a11"},{"type":"FIX","url":"https://github.com/discourse/discourse/commit/a5d3b112d598242c1d1803d5a77bf98d5fdabd75"},{"type":"FIX","url":"https://github.com/discourse/discourse/commit/b25a074b165253e01fc4c8911b980fc68338ea16"},{"type":"FIX","url":"https://github.com/discourse/discourse/pull/42244"},{"type":"FIX","url":"https://github.com/discourse/discourse/pull/42245"},{"type":"FIX","url":"https://github.com/discourse/discourse/pull/42246"},{"type":"FIX","url":"https://github.com/discourse/discourse/pull/42247"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/discourse/discourse","events":[{"introduced":"0"},{"introduced":"06d03da34c4ed09ea59f917f045ba250d2b6320d"},{"introduced":"ded677e00beb0e9bae6e70b69582aecfb72b5477"},{"introduced":"fb9247e04a826ab8e4d91168b3c4c839ec40bccc"},{"fixed":"b6af77c0382ac61817e825e4e285217327772b54"},{"fixed":"ac368a8cac47e413b99f122c890e32c133a4bacc"},{"fixed":"cbf996f65aae3da1843224aa624bcd9a225931ac"},{"fixed":"b88e77d40524f929740726615f4c081efa3a405c"},{"fixed":"234ee88a5b9b53bf938c53351eab20130323485f"},{"fixed":"4b639a52f47fb3d46093bece9df147e4e9517a11"},{"fixed":"a5d3b112d598242c1d1803d5a77bf98d5fdabd75"},{"fixed":"b25a074b165253e01fc4c8911b980fc68338ea16"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2026.1.7"},{"introduced":"2026.6.0-latest"},{"fixed":"2026.6.2"},{"introduced":"2026.7.0-latest"},{"fixed":"2026.7.1"},{"introduced":"2026.8.0-latest"},{"fixed":"2026.8.0-latest.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v2026.1.6","v2026.7.0","v2026.6.1","v2026.8.0-latest","_gh-attach-assets","v2026.1.5","v2026.6.0","v2026.7.0-latest","v2026.6.0-latest","v2026.1.4","v2026.1.3","v2026.1.2","v2026.1.1","v2026.1.0","stable","esr","v2026.1.0-latest","v2025.12.0-latest","v3.6.0.beta2","v3.6.0.beta1","v3.5.0.beta9","v3.5.0.beta8","v3.5.0.beta7","v3.5.0.beta6","v3.5.0.beta5","v3.5.0.beta4","v3.5.0.beta3","v3.5.0.beta2","v3.5.0.beta1","v3.4.0.beta4","v3.4.0.beta3","v3.4.0.beta2","v3.4.0.beta1","v3.3.0.beta5","v3.3.0.beta6","v3.3.0.beta4","v3.3.0.beta3","v3.3.0.beta2","v3.3.0.beta1","v3.2.0.beta5","v3.2.0.beta4","v3.2.0.beta3","v3.2.0.beta2","v3.2.0.beta1","v3.1.0.beta8","v3.1.0.beta7","v3.1.0.beta6","v3.1.0.beta5","v3.1.0.beta4","v3.1.0.beta3","v3.1.0.beta2","v3.1.0.beta1","v3.0.0.beta16","v3.0.0.beta15","v2.9.0.beta14","v2.9.0.beta13","v2.9.0.beta12","v2.9.0.beta11","v2.9.0.beta10","v2.9.0.beta9","v2.9.0.beta8","v2.9.0.beta7","v2.9.0.beta6","v2.9.0.beta5","v2.9.0.beta4","v2.9.0.beta3","v2.9.0.beta2","v2.9.0.beta1","v2.8.0.beta11","v2.8.0.beta10","v2.8.0.beta9","v2.8.0.beta8","v2.8.0.beta7","v2.8.0.beta6","v2.8.0.beta5","v2.8.0.beta4","v2.8.0.beta3","v2.8.0.beta2","v2.8.0.beta1","v2.7.0.beta9","v2.7.0.beta8","v2.7.0.beta7","v2.7.0.beta6","v2.7.0.beta5","v2.7.0.beta4","v2.7.0.beta3","v2.7.0.beta2","v2.7.0.beta1","v2.6.0.beta6","v2.6.0.beta5","v2.6.0.beta4","v2.6.0.beta3","v2.6.0.beta2","v2.6.0.beta1","v2.5.0.beta7","v2.5.0.beta6","v2.5.0.beta5","v2.5.0.beta4","v2.5.0.beta3","v2.5.0.beta2","v2.5.0.beta1","v2.4.0.beta11","v2.4.0.beta10","v2.4.0.beta9","v2.4.0.beta8","v2.4.0.beta7","v2.4.0.beta6","v2.4.0.beta5","v2.4.0.beta4","v2.4.0.beta3","v2.4.0.beta2","v2.4.0.beta1","v2.3.0.beta11","v2.3.0.beta10","v2.3.0.beta9","v2.3.0.beta8","v2.3.0.beta7","v2.3.0.beta6","v2.3.0.beta5","v2.3.0.beta4","v2.3.0.beta3","v2.3.0.beta2","v2.3.0.beta1","v2.2.0.beta10","v2.2.0.beta9","v2.2.0.beta8","v2.2.0.beta7","v2.2.0.beta6","v2.2.0.beta5","v2.2.0.beta4","v2.2.0.beta3","v2.2.0.beta2","v2.2.0.beta1","v2.1.0.beta6","v2.1.0.beta5","v2.1.0.beta4","v2.1.0.beta3","v2.1.0.beta2","v2.1.0.beta1","v2.0.0.beta10","v2.0.0.beta9","v2.0.0.beta8","v2.0.0.beta7","v2.0.0.beta6","v2.0.0.beta5","v2.0.0.beta4","v2.0.0.beta3","v2.0.0.beta2","v2.0.0.beta1","v1.9.0.beta17","v1.9.0.beta16","v1.9.0.beta15","v1.9.0.beta14","v1.9.0.beta13","v1.9.0.beta12","v1.9.0.beta11","v1.9.0.beta10","v1.9.0.beta9","v1.9.0.beta8","v1.9.0.beta7","v1.9.0.beta6","v1.9.0.beta5","v1.9.0.beta4","v1.9.0.beta3","v1.9.0.beta2","v1.9.0.beta1","v1.8.0.beta13","v1.8.0.beta12","v1.8.0.beta11","v1.8.0.beta10","v1.8.0.beta9","v1.8.0.beta8","v1.8.0.beta7","v1.8.0.beta6","v1.8.0.beta5","v1.8.0.beta4","v1.8.0.beta3","v1.8.0.beta2","v1.8.0.beta1","v1.7.0.beta11","v1.7.0.beta10","v1.7.0.beta9","v1.7.0.beta8","v1.7.0.beta7","v1.7.0.beta6","v1.7.0.beta5","v1.7.0.beta4","v1.7.0.beta3","v1.7.0.beta1","v1.7.0.beta2","v1.6.0.beta12","v1.6.0.beta11","v1.6.0.beta10","v1.6.0.beta9","v1.6.0.beta8","v1.6.0.beta7","v1.6.0.beta6","v1.6.0.beta5","v1.6.0.beta4","v1.6.0.beta3","v1.6.0.beta2","v1.6.0.beta1","v1.5.0.beta14","v1.5.0.beta13b","v1.5.0.beta13","v1.5.0.beta12","v1.5.0.beta11","v1.5.0.beta10","v1.5.0.beta9","v1.5.0.beta8","v1.5.0.beta7","v1.5.0.beta6","v1.5.0.beta5","v1.5.0.beta4","v1.5.0.beta2","v1.5.0.beta1","v1.4.0.beta12","v1.4.0.beta11","v1.4.0.beta10","v1.4.0.beta9","v1.4.0.beta8","v1.4.0.beta7","v1.4.0.beta6","v1.4.0.beta5","v1.4.0.beta4","v1.4.0.beta3","v1.4.0.beta2","v1.4.0.beta1","v1.3.0.beta11","v1.3.0.beta10","v1.3.0.beta9","v1.3.0.beta6","v1.3.0.beta5","v1.3.0.beta4","v1.3.0.beta3","v1.3.0.beta2","v1.3.0.beta1","v1.2.0.beta9","v1.2.0.beta8","v1.2.0.beta7","v1.2.0.beta6","v1.2.0.beta5","v1.2.0.beta4","v1.2.0.beta3","v1.2.0.beta2","v1.2.0.beta1","v1.1.0.beta8","v1.1.0.beta7","v1.1.0.beta6b","v1.1.0.beta6","v1.1.0.beta5","v1.1.0.beta4","v1.1.0.beta3","v1.1.0.beta2","v1.0.0","v0.9.9.18","v0.9.9.17","v0.9.9.16","v0.9.9.15","v0.9.9.14","v0.9.9.13","v0.9.9.12","v0.9.9.11","v0.9.9.10","v0.9.9.9","v0.9.9.8","v0.9.9.7","v0.9.9.6","v0.9.9.5","v0.9.9.4","v0.9.9.3","v0.9.9.2","v0.9.9.1","v0.9.8.11","v0.9.8.10","v0.9.8.9","v0.9.8.8","v0.9.8.7","v0.9.8.6","v0.9.8.5","v0.9.8.4","v0.9.8.3","v0.9.8.2","v0.9.8.1","v0.9.8","v0.9.7.9","v0.9.7.8","v0.9.7.7","v0.9.7.6","v0.9.7.5","v0.9.7.4","v0.9.7.3","v0.9.7.2","v0.9.7.1","v0.9.7","v0.9.6.4","v0.9.6.3","v0.9.6.1","v0.9.6","v0.9.5.2","v0.9.5.1","v0.9.5","v0.9.4","v0.9.3","v0.9.2.6","v0.9.2.5","v0.9.2","v0.9.1","v0.9.0","v0.8.9","v0.8.8","v0.8.7","v0.8.6","v0.8.5","v0.8.4","v0.8.3","v0.8.2","v0.8.1","v0.8.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72720.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}]}