CVE-2026-27166: 
NixOS vulnerability analysis and mitigation

CVE-2026-27166 is an HTML injection vulnerability in Discourse, an open source discussion platform, caused by insufficient cleanup of the default Codepen allowed iframes value. It allows an authenticated attacker to trick a user into changing the URL of the main page (URL redirection/HTML injection via iframe). Affected versions include all releases prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. The vulnerability was published on March 19, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) per Feedly threat intelligence, or 4.1 (Moderate) per the GitHub Security Advisory (GitHub Advisory, Feedly).

The root cause is improper neutralization of script-related HTML tags in a web page (CWE-80), specifically the failure to decode and validate URL-encoded path traversal sequences in iframe src attributes before applying the allowlist check. The sanitizer in frontend/pretty-text/addon/sanitizer.js previously matched the raw (URL-encoded) value against the allowed iframes list without first decoding it, allowing an attacker to craft a Codepen iframe URL containing URL-encoded path traversal sequences (e.g., %2F..%2F) that bypass the allowlist regex and cause the browser to navigate the parent page to an attacker-controlled URL. The fix decodes the src value via decodeURIComponent() before applying both the path-traversal check and the allowlist regex (GitHub Commit, GitHub Advisory).

Successful exploitation allows an attacker to redirect authenticated Discourse users to arbitrary URLs, including phishing sites or pages hosting malicious content, by embedding a crafted Codepen iframe in a Discourse post. The integrity of user interactions within the platform is affected, as users may be silently navigated away from the legitimate Discourse instance. Confidentiality and availability impacts are assessed as none; the primary risk is social engineering and phishing facilitated by the redirect (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The vulnerability requires the attacker to have a low-privilege account on the Discourse instance and requires user interaction (a victim must view the malicious post). The EPSS score is approximately 0.03%, indicating a very low probability of exploitation in the near term. No threat actor attribution or CISA KEV catalog listing has been identified.

1. Obtain low-privilege access: Register or log in to a target Discourse instance running a vulnerable version (prior to 2026.3.0-latest.1, 2026.2.1, or 2026.1.2).
2. Craft a malicious iframe URL: Construct a Codepen iframe src URL that uses URL-encoded path traversal sequences (e.g., https://codepen.io/abc%2F..%2F..%2F pointing to an attacker-controlled destination) to bypass the sanitizer's allowlist check.
3. Embed in a post: Create or edit a Discourse post containing the crafted iframe tag, leveraging the fact that Codepen is in the default allowed iframes list.
4. Deliver to victim: Share the post link with a target user or post it in a public/private category where victims are likely to view it.
5. Trigger redirect: When the victim views the post, the malicious iframe causes the browser to navigate the main page URL to the attacker-controlled destination, potentially leading to credential phishing or malware delivery (GitHub Advisory, GitHub Commit).

• Logs: Discourse application logs showing posts or edits containing iframe tags with URL-encoded sequences (e.g., %2F, %2f, %2E, %2e) in the src attribute pointing to Codepen or other allowed iframe domains.
• Network: Unexpected outbound browser navigations from Discourse pages to non-Discourse domains, particularly following iframe loads from Codepen URLs with encoded path components.
• Content: Posts in the Discourse database containing iframe src values with URL-encoded path traversal patterns such as %2F..%2F or %2f..%2f within otherwise allowed iframe domains.

Upgrade Discourse to one of the patched versions: 2026.3.0-latest.1, 2026.2.1, or 2026.1.2. If immediate patching is not possible, remove Codepen from the list of allowed iframes in the Discourse site settings (allowed_iframes configuration) as a temporary workaround. Administrators should also audit existing posts for iframe tags containing URL-encoded path traversal sequences (GitHub Advisory, GitHub Commit).