CVE-2025-54411

Published: Aug 19, 2025Modified: Jun 17, 2026

2.4

Vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security-advisories@github.com (Secondary)

Description

Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcome_banner.header.logged_in_members site text to remove the preferred_display_name placeholder, or not impersonate any users for the time being. This vulnerability is fixed in 3.5.0.beta8.

Affected (8)

Products: Discourse: Discourse

Discourse

1 product

Discourse

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Discourse Discourse	Before 3.5.0
Discourse Discourse	Version 3.5.0 beta1
Discourse Discourse	Version 3.5.0 beta2
Discourse Discourse	Version 3.5.0 beta3
Discourse Discourse	Version 3.5.0 beta4
Discourse Discourse	Version 3.5.0 beta5
Discourse Discourse	Version 3.5.0 beta6
Discourse Discourse	Version 3.5.0 beta7

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://github.com/discourse/discourse/commit/a3374d2850f07444d113216e1d539ee21650dbff

Source: security-advisories@github.com

Patch

https://github.com/discourse/discourse/security/advisories/GHSA-5mm6-j5vq-6884

Source: security-advisories@github.com

MitigationThird Party Advisory

Timeline

No history available yet.