Hii so basically server doesn’t check if the emoji sent by the client is valid so the client is able to change “title” and “alt” attributes for the emoji <img with inspect element and send a custom message in an emoji, for someone not experienced with computers it may seem like the person wrote the…

Not following, can you reply with an example? This looks like retort which is not an official plugin. Discourse reactions renders differently.

Ah, so it’s an external plugin, I had no idea. Yes, it seems to be retort from the body of the request when reacting with emoji.

https://github.com/gdpelican/retort/issues/76 it’s even reported on the repo so yeah

For future travelers here, our official plugin is: [image] Discourse Reactions Plugin discourse2 Summary Discourse Reactions allows users to React to a post from a choice of emojis, rather than only the Like heart. The available emoji selection can be se…

Possible security issue with discourse retort emojis

Support

sam (Sam Saffron) May 15, 2022, 11:45pm 7

For future travelers here, our official plugin is:

This issue does not impact the official plugin.

Topic		Replies	Views
I don't know if this is my delusion or if it really existed Support	5	725	April 16, 2023
Discourse Retort Plugin end-of-life	479	68236	August 19, 2025
Reaction emojis Support	3	1172	January 15, 2024
Add ... option to Discourse Reactions Feature reactions	28	3097	October 5, 2025
Discourse Reactions Plugin official , reactions , included-in-core	53	39835	August 13, 2025

Possible security issue with discourse retort emojis

Related topics