Discourse, an open-source discussion platform, has a critical vulnerability (CVE-2026-55674) affecting certain versions before 2026.1.6, 2026.5.2, and 2026.6.1. The flaw arises because the color_scheme_id and dark_scheme_id cookie values are rendered into a color scheme tag without proper escaping. An attacker can craft a cookie to break out of the attribute context and inject arbitrary HTML, which bypasses the nonce-based Content Security Policy. This leads to arbitrary JavaScript execution in the browsers of site visitors. The vulnerability is addressed in Discourse versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

An unauthenticated attacker can execute arbitrary JavaScript in the browsers of visitors to a vulnerable Discourse instance by exploiting the cookie injection flaw. This can lead to cross-site scripting (XSS) attacks, potentially compromising user sessions, stealing sensitive information, or performing actions on behalf of users.

Apply the official patches by upgrading Discourse to version 2026.1.6, 2026.5.2, 2026.6.1, or later versions such as 2026.7.0. These versions contain fixes that properly escape cookie values to prevent injection and bypass of the Content Security Policy. No other mitigation is indicated by the vendor advisory.