Discourse, an open-source discussion platform, had a stored XSS vulnerability identified as CVE-2026-55424. The vulnerability exists in the handling of the topic featured link, which was insufficiently normalized and escaped prior to rendering in the topic list. This flaw allows an attacker who can set a featured link to inject arbitrary JavaScript code, but only if the default Content Security Policy protections are disabled or altered. The vulnerability affects versions prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 and has been fixed in these versions.

An attacker with the ability to set a featured link can inject malicious JavaScript code that executes in the context of users viewing the topic list, but only if the default Content Security Policy protections are modified or disabled. This can lead to typical XSS impacts such as session hijacking, defacement, or other client-side attacks. There are no known exploits in the wild at this time.

Upgrade Discourse to version 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5 or later, where this vulnerability has been fixed. Ensure that the default Content Security Policy protections are enabled and not weakened, as the vulnerability requires CSP modifications to be exploitable.