Discourse HTML Injection Vulnerability via Prohibited iframe URLs

A vulnerability in Discourse prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 allows for HTML injection. Insufficient cleanup in the default Codepen iframe allowance can be exploited to manipulate the main page URL. This issue requires user interaction to be exploited.

Impact

Exploitation of this vulnerability could lead to unauthorized URL manipulation on the affected user's main page.

Reproduction

The vulnerability can be reproduced by embedding an iframe with a URL that includes URL-encoded path traversal into a Codepen that allows iframes. When the Codepen is rendered, the main page URL will be altered, demonstrating the injection flaw.

Remediation

Users can remove Codepen from the list of allowed iframes to mitigate this vulnerability.