CVE-2026-27154: 
NixOS vulnerability analysis and mitigation

CVE-2026-27154 is a stored Cross-Site Scripting (XSS) vulnerability in Discourse, an open-source discussion platform. When two specific site settings are enabled — display_name_on_posts set to true and prioritize_username_in_ux set to false — a user's full name field is rendered as raw HTML, allowing a malicious actor to inject arbitrary JavaScript. The vulnerability was published on February 26, 2026, and affects Discourse versions prior to 2025.12.2, versions 2026.1.0 through 2026.1.0 (before 2026.1.1), and versions prior to 2026.2.0. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), where user-supplied input in the full name field is not properly sanitized before being rendered in the post editing interface (GitHub Advisory). The attack requires two non-default site configuration settings to be active simultaneously: display_name_on_posts => true and prioritize_username_in_ux => false. Under these conditions, when a victim edits a post authored by a malicious user, the attacker's full name — containing embedded HTML/JavaScript — is evaluated and executed in the victim's browser context. The attack vector is network-based and requires user interaction (the victim must edit the malicious post), but no special privileges are needed on the attacker's side beyond having a registered account.

Successful exploitation results in arbitrary JavaScript execution in the context of the victim's browser session on the Discourse instance. This can lead to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim (such as posting, modifying settings, or accessing private messages), and potential account takeover. The confidentiality and integrity impacts are limited in scope but could be escalated if an administrator is targeted, potentially compromising the entire Discourse instance (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-27154. The EPSS score is approximately 0.047%, indicating a low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a specific non-default configuration and user interaction, which limits its practical attack surface.

1. Account Registration: The attacker registers a user account on a vulnerable Discourse instance where display_name_on_posts is true and prioritize_username_in_ux is false.
2. Payload Injection: The attacker sets their account's full name to a malicious HTML/JavaScript payload, such as <img src=x onerror=alert(document.cookie)> or a more sophisticated script designed to exfiltrate session tokens.
3. Post Creation: The attacker creates or contributes a post on the forum, causing their display name (with the injected payload) to be associated with that post.
4. Victim Interaction: A victim (ideally a moderator or administrator) navigates to edit the attacker's post. During the editing workflow, the attacker's full name is rendered as raw HTML in the victim's browser.
5. XSS Execution: The injected JavaScript executes in the victim's browser context, potentially stealing session cookies, performing actions on behalf of the victim, or redirecting to a phishing page (GitHub Advisory).

• Logs: Discourse application logs showing unexpected edits to posts authored by newly registered or low-activity users; access logs with unusual patterns of POST requests to post-editing endpoints.
• Network: Outbound requests from victim browsers to attacker-controlled domains following post-edit actions; unexpected data exfiltration (e.g., cookies or tokens) in HTTP request parameters or headers.
• User Activity: Accounts with full name fields containing HTML tags (<script>, <img>, onerror=, etc.); unusual account actions (e.g., settings changes, private message access) immediately following a post-edit event.
• Browser/Client: JavaScript errors or unexpected redirects occurring specifically during the post-editing workflow in Discourse.

Discourse has released patched versions 2025.12.2, 2026.1.1, and 2026.2.0 (and later 2026.3.0-latest per the GitHub advisory) that address this vulnerability. Administrators should upgrade to one of these patched versions as the primary remediation, as no configuration-based workarounds are available. As a temporary risk-reduction measure (not an official workaround), administrators could set display_name_on_posts to false or prioritize_username_in_ux to true to prevent the vulnerable code path from being triggered until an upgrade is possible (GitHub Advisory).

The vulnerability was disclosed by Discourse maintainer davidtaylorhq via a GitHub Security Advisory on February 26, 2026. Coverage has been limited to automated vulnerability tracking services such as Vulners, CVEFeed, and ENISA's EUVD. No significant independent researcher commentary, media coverage, or notable social media discussion has been identified beyond routine CVE aggregation (GitHub Advisory).