Discourse vulnerable to unlimited mentioned users in message serializer

CVE-2023-48297

What is CVE-2023-48297?

A vulnerability has been identified in Discourse, a platform designed for community discussions, specifically related to its message serialization functionality. The issue arises when the system processes chat mentions like @all and @here, which can lead to a significantly long array of users being included. This has the potential to create performance issues or exploitative scenarios within the application. The vulnerability has been addressed in the updates provided in versions 3.1.4 and beta 3.2.0.beta5.

References