Vulnerability Report

CVE-2026-53962

Title: XSS via insufficient SVG sanitization in Discourse

XSS

Proof Of Concept

No public PoC currently indexed for CVE-2026-53962.

CWE Category CWE-79

Published Date Jul 09, 2026

Modified Date Jul 14, 2026

Exploit Status Not Found

Score 5.4 CVSS v3.1

Exploit Probability (EPSS)

0.27%

Vulnerability Summary

CVE-2026-53962: Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, insufficient SVG sanitization in upload and user avatar handling could lead to cross-site scripting when a user visited specific URLs that are not normally part of community browsing. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Impacted Vendors

discourse 1

Reference Links

https://github.com/discourse/discourse/commit/3ee8343cd7f00d59d8513bee0a12e02d50bfc358 https://github.com/discourse/discourse/commit/810c2715799fd08b06fd6ffc664d9562fe9ea6ff https://github.com/discourse/discourse/commit/92a699d89b84685b6fdd63cd0d0e371793c69dad https://github.com/discourse/discourse/commit/b8ceb49f4ba52257be30eb3c2ce51a5bf03be5fe https://github.com/discourse/discourse/releases/tag/v2026.1.5 https://github.com/discourse/discourse/releases/tag/v2026.4.2 https://github.com/discourse/discourse/releases/tag/v2026.5.1 https://github.com/discourse/discourse/releases/tag/v2026.6.0 https://github.com/discourse/discourse/security/advisories/GHSA-jmcf-3367-78vv

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

5.4

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-53962 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

July 14, 2026 MODIFIED

Vulnerability data updated via NVD.

July 10, 2026 MODIFIED

Vulnerability data updated via NVD.

July 10, 2026 MODIFIED

Vulnerability data updated via NVD.

July 09, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction REQUIRED

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected Stack

No specific products linked.