Arbitrary JavaScript Execution Vulnerability in Discourse by Discourse

CVE-2025-48877

What is CVE-2025-48877?

The Discourse platform contains a flaw that allows for arbitrary JavaScript execution due to the unintended inclusion of Codepen in the default allowed_iframes setting. This could allow malicious content to run within the scope of iframes on affected Discourse sites, leading to potential exploitation. The vulnerability has been addressed in later versions, and users are advised to update their software or remove the Codepen prefix from their allowed_iframes configuration as a temporary measure.

References