CVE-2025-48954

Published: Jun 25, 2025Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Discourse is an open-source discussion platform. Versions prior to 3.5.0.beta6 are vulnerable to cross-site scripting when the content security policy isn't enabled when using social logins. Version 3.5.0.beta6 patches the issue. As a workaround, have the content security policy enabled.

Affected (6)

Products: Discourse: Discourse

Discourse

1 product

Discourse

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Discourse Discourse	Before 3.5.0
Discourse Discourse	Version 3.5.0 beta1
Discourse Discourse	Version 3.5.0 beta2
Discourse Discourse	Version 3.5.0 beta3
Discourse Discourse	Version 3.5.0 beta4
Discourse Discourse	Version 3.5.0 beta5

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

https://github.com/discourse/discourse/security/advisories/GHSA-26p5-mjjh-wfcf

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.