CVE-2017-20290
Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed
Discourse DiscourseApplications & CMS
CVSS
5.1MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.9.0.beta13DiscourseCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb renders unescaped via html_safe, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Text from CVE List
Affected versions 1
- Discourseaffected: 1.9.0.beta2 before 1.9.0.beta13CVE List
References 4
- github.com/discourse/discourse/commit/a6f2533d38Fixvia CVE List
- github.com/discourse/discourse/commit/6e37f09b19Fixvia CVE List
- vulncheck.com/advisories/discourse-1.9.0-beta13-reflected-xss-via-email-unsubscribedAdvisoryvia CVE List
- github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/discourse-xss.yamlReferencevia CVE List