CVE-2025-46824

Published: May 7, 2025Modified: Jun 17, 2026Deferred

3.1

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 1.6 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

The Discourse Code Review Plugin allows users to review GitHub commits on Discourse. Prior to commit eed3a80, an attacker can execute arbitrary JavaScript on users' browsers by posting links to malicious GitHub commits. This problem is patched in commit eed3a80 of the discourse-code-review plugin. As a workaround, one may disable the plugin.

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://github.com/discourse/discourse-code-review/commit/eed3a801f8fee217fe782212d8950eb1bd236e43

Source: security-advisories@github.com

https://github.com/discourse/discourse-code-review/security/advisories/GHSA-358v-cwvc-gxh5

Source: security-advisories@github.com

https://www.vicarius.io/vsociety/posts/cve-2025-46824-detect-discourse-plugin-vulnerability

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.vicarius.io/vsociety/posts/cve-2025-46824-mitigate-discourse-plugin-vulnerability

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.