Live › vulnerability › CVE-2017-20290
Go to dashboardDiscourse versions from 1.9.0.beta2 before 1.9.0.beta13 render the email parameter of the /email/unsubscribed page without escaping. An unauthenticated attacker can send a victim a crafted GET link with an SVG onload payload to run JavaScript in the victim's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Discourse instances running a version from 1.9.0.beta2 up to but not including 1.9.0.beta13 are exposed, because the flaw is in the unsubscribe template that any visitor can reach without logging in. Hosted Discourse services are maintained by their vendor, so the team running the instance should confirm the version it is on. Instances already on a later release are not affected.
No product ranges from the sources yet.
version file in the Discourse install directory/email/unsubscribed requests with email= values containing <svg or onload in web server access logs1.9.0.beta13 or later, which the advisory names as the fixed releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb renders unescaped via html_safe, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
This page as .md · .json · in your agent: get_signal("CVE-2017-20290")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.