Septembre 2026

discourse

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could create a post for an enabled YouTube, Vimeo, or TikTok provider whose title contained markup, and the email and chat-summary rendering path would place that markup into the output instead of treating it solely as text. Recipients using HTML-capable email clients could see injected content, potentially including event handlers, but the issue did not directly expose a Discourse browser session or affect the forum page itself. Lazy video embeds must be enabled, which is the default configuration. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

edwardkim rhwp

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, URL schemes, or destination addresses before privileged fetches. The affected paths are rhwp-chrome/manifest.json, rhwp-chrome/content-script.js, rhwp-chrome/sw/message-router.js, rhwp-chrome/sw/thumbnail-extractor.js, rhwp-firefox/manifest.json, rhwp-firefox/content-script.js, rhwp-firefox/sw/message-router.js, and rhwp-firefox/sw/thumbnail-extractor.js. An untrusted page can make the fetch-file and extract-thumbnail handlers request localhost or private-network resources. When a target HWP or HWPX file contains an extractable PrvImage, the extension returns the preview as a data URI in page-readable DOM, allowing page script to read it. The flaw also permits internal-resource existence and port probing and extension presence or version fingerprinting. Exploitation requires a user to visit an untrusted page while the extension is enabled, and preview disclosure is limited to an extractable PrvImage. This issue is fixed in rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4.