Discourse 1.9.0.beta2-beta12 XSS via /email/unsubscribed email param
CVE-2017-20290 Published on October 22, 2026
Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed
Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb renders unescaped via html_safe, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Vulnerability Analysis
CVE-2017-20290 is exploitable with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2017-20290 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2017-20290
Want to know whenever a new CVE is published for Discourse? stack.watch will email you.
Affected Versions
Discourse:- Version 1.9.0.beta2 and below 1.9.0.beta13 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.