CVE-2026-72729: Discourse Local Dates Plugin XSS Flaw

CVE-2026-72729 Overview

CVE-2026-72729 is an HTML injection vulnerability in the discourse-local-dates plugin shipped with Discourse, an open-source discussion platform. Prior to the fixed releases, the plugin rendered crafted local-date format data directly as HTML in the browser. The flaw affects sites that have a modified or disabled default Content Security Policy (CSP), where the default CSP would otherwise block script execution. The issue is classified as Cross-Site Scripting [CWE-79] and is resolved in Discourse versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Critical Impact
Authenticated users can inject HTML into rendered local-date components, enabling client-side script execution on Discourse instances that have relaxed or disabled the default CSP.

Affected Products

Discourse versions prior to 2026.1.6 (1.x maintenance branch)
Discourse versions prior to 2026.5.2 and 2026.6.1 (stable branches)
Discourse versions prior to 2026.7.0 (current branch)

Discovery Timeline

2026-08-10 - CVE-2026-72729 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72729

Vulnerability Analysis

The discourse-local-dates plugin renders user-supplied date formatting data inside a rendered post. The plugin built a <span class="relative-time"> element by concatenating the formatted date string into an HTML template literal and passing it to insertAdjacentHTML. Because the formatted value was interpolated as raw HTML rather than text, a crafted date format could break out of the intended span and inject arbitrary markup. On Discourse instances running the default CSP, script tags and inline handlers are blocked, limiting impact. Instances that modified or disabled the default CSP lose that mitigation, allowing standard HTML injection and script execution paths.

Root Cause

The root cause is unsanitized string interpolation in the client-side rendering path of the plugin. The vulnerable code passed localDateBuilder.formatted directly into insertAdjacentHTML, treating attacker-influenced data as trusted markup. This violates the principle of separating data from code at DOM insertion boundaries.

Attack Vector

Exploitation requires an authenticated user with permission to post content containing a local-date component. The attacker crafts a post whose date format payload contains HTML markup. When another user renders the post, the injected markup is inserted into the DOM. Successful script execution depends on the target site having relaxed its default CSP.

javascript

// Patch from plugins/discourse-local-dates/assets/javascripts/initializers/discourse-local-dates.js
// Before (vulnerable): formatted value interpolated as HTML
     element.insertAdjacentHTML(
       "beforeend",
       `${iconHTML("earth-americas")}
-        <span class="relative-time">${localDateBuilder.formatted}</span>`
+        `
     );
+    // After (fixed): value assigned via textContent, preventing HTML parsing
+    const relativeTime = document.createElement("span");
+    relativeTime.classList.add("relative-time");
+    relativeTime.textContent = localDateBuilder.formatted;
+    element.appendChild(relativeTime);
     element.setAttribute("aria-label", localDateBuilder.textPreview);

     const classes = ["cooked-date"];

Source: Discourse commit 9768f47. The fix replaces raw HTML insertion with document.createElement and textContent assignment, ensuring the formatted value is treated as text rather than markup.

Detection Methods for CVE-2026-72729

Indicators of Compromise

Discourse posts containing local-date components where the format string includes HTML tags such as <img, <svg, <iframe, or event handler attributes like onerror= and onload=.
Browser console errors referencing CSP violations on pages that render user posts with local-date widgets.
Unexpected outbound requests initiated from Discourse post-render pages to attacker-controlled hosts.

Detection Strategies

Audit the posts and post_revisions tables in the Discourse database for [date=...] bbcode tokens containing angle brackets or HTML entity sequences in the format parameter.
Review the site's Content Security Policy configuration in Discourse admin settings; sites that disabled or weakened content_security_policy are in scope for exploitation.
Search web server access logs for CSP report endpoints receiving violation reports tied to post render paths.

Monitoring Recommendations

Enable Discourse CSP violation reporting and forward reports to a centralized logging pipeline for correlation.
Monitor Discourse admin logs for changes to CSP settings and to plugin configuration for discourse-local-dates.
Alert on new or modified posts by low-reputation accounts that contain local-date bbcode with unusual format values.

How to Mitigate CVE-2026-72729

Immediate Actions Required

Upgrade Discourse to 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 depending on the deployed branch.
Re-enable the default Content Security Policy if it has been disabled or weakened, which reintroduces the mitigating control against script execution.
Review recent posts using the discourse-local-dates plugin for suspicious format payloads and rebake posts after patching.

Patch Information

The fix is available in Discourse releases 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. Technical details and patch commits are published in the GitHub Security Advisory GHSA-rw96-2xg7-h54g and applied across the 1.x backport commit, the 5.x backport commit, the 6.x backport commit, and the main branch commit.

Workarounds

Restore the default Discourse Content Security Policy, which blocks inline script execution from injected markup.
Temporarily disable the discourse-local-dates plugin if upgrading immediately is not possible.
Restrict posting privileges on the local-date bbcode to trusted user trust levels until the patch is deployed.

bash

# Restore the default CSP in Discourse admin settings via rails console
cd /var/www/discourse
sudo -u discourse bundle exec rails runner \
  "SiteSetting.content_security_policy = true; \
   SiteSetting.content_security_policy_strict_dynamic = true"

# Rebake all posts after upgrading to re-render local-date components safely
sudo -u discourse bundle exec rake posts:rebake