Arbitrary JavaScript Execution Vulnerability in Discourse by Discourse
CVE-2025-48877

8.1HIGH

Key Information:

Vendor

Discourse
Status
Discourse
Vendor
CVE Published:
9 June 2025

What is CVE-2025-48877?

The Discourse platform contains a flaw that allows for arbitrary JavaScript execution due to the unintended inclusion of Codepen in the default allowed_iframes setting. This could allow malicious content to run within the scope of iframes on affected Discourse sites, leading to potential exploitation. The vulnerability has been addressed in later versions, and users are advised to update their software or remove the Codepen prefix from their allowed_iframes configuration as a temporary measure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

discourse < 3.4.4 < 3.4.4

discourse < 3.5.0.beta5 < 3.5.0.beta5

discourse < 3.5.0.beta6-dev < 3.5.0.beta6-dev

References

https://github.com/discourse/discourse/security/advisorie...
x_refsource_CONFIRM

CVSS V4

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.