CVE-2026-27166

XSS in Discourse ≤ 2026.3.0

XSS

Published

19 March 2026

Modified

25 March 2026

Patch / advisory

View advisory

CVSS Score v3.1 4.1

Click a component to see what it means

Raw vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

EPSS Score 0.0019 9th percentile

Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-27166 is a medium-severity Basic XSS (CWE-80) vulnerability in Discourse Discourse. Its CVSS base score is 4.1 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to CM-7 (Least Functionality) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-13187

Vulnerability Data

Discourse is an open source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2, insufficient cleanup in the default Codepen allowed iframes value allows an attacker to trick a user into changing the URL of the main page. This issue…

has been fixed in versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2. To workaround this issue, remove Codepen from the list of allowed iframes.

CWE(s): CWE-80

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The XSS/iframe sanitization flaw in a public-facing web app (Discourse) directly enables exploitation of the application itself.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-46413Same product: Discourse Discourse

CVE-2026-33426Same product: Discourse Discourse

CVE-2026-29072Same product: Discourse Discourse

CVE-2026-27481Same product: Discourse Discourse

CVE-2026-32619Same product: Discourse Discourse

CVE-2026-45788Same product: Discourse Discourse

CVE-2026-27150Same product: Discourse Discourse

CVE-2026-27151Same product: Discourse Discourse

CVE-2026-27934Same product: Discourse Discourse

CVE-2026-32615Same product: Discourse Discourse

Affected Assets

discourse

2026.3.0 · ≤ 2026.3.0 · 2026.1.0 — 2026.1.2 · 2026.2.0 — 2026.2.1

Mitigating Controls

Control response

Prevent

Stop it (NIST 800-53)

SI-10 Information Input Validation
CM-7 Least Functionality
AC-4 Information Flow Enforcement

Detect

Catch it (NIST detect / respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V1.2.1
V1.3.1
V1.3.3
V1.3.4

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match

prevent

Directly requires validation and sanitization of untrusted input such as the allowed-iframe list to prevent insufficient cleanup that enables URL manipulation.

CM-7 Least Functionality good match

prevent

Enforces disabling or removing unnecessary features (CodePen iframe embedding) exactly as recommended in the CVE workaround.

AC-4 Information Flow Enforcement partial match

prevent

Enforces information-flow rules that restrict which external domains may be rendered inside iframes, limiting the attack surface.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match

prevents

Secure SDLC practices directly require output encoding and input validation that prevent basic XSS.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match

detects

Security testing in development catches unneutralized script tags before release.

A.8.25 Secure development life cycle partial match

prevents

Secure SDLC mandates input validation and output encoding that directly prevent basic XSS.

A.8.26 Application security requirements partial match

prevents

Application security requirements explicitly call for neutralization of script-related HTML tags.

A.8.28 Secure coding partial match

prevents

Secure coding standards require proper escaping of <, >, & to block XSS.