Preliminary research

A JPEG, a Race, and a Ghost: Breaking Discourse's Image Pipeline

Kevin Gervot

AI-collected research leads through 9 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Discourse's anonymous page cache omitted color scheme cookies from its key, allowing a crafted cookie to poison pages with a modulepreload element that bypassed CSP and executed script for visitors. A separate image upload chain combined a JPEG/JXL polyglot, Ghostscript PDF processing, and an atomic tempfile race to reach ImageMagick MSL file read and write.

Record

Researcher

Kevin Gervot

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Image-upload advisory
• Cache-poisoning advisory

Tags

• cache-poisoning
• xss
• csp
• file-upload
• race-condition
• ghostscript
• imagemagick
• file-read
• owasp-a03-2021
• owasp-a04-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Kevin Gervot, first published at the original source. Preserved copies are kept so the citation survives its host.