Cross-Site Scripting Vulnerability in Discourse Open Source Discussion Platform

CVE-2025-48954

What is CVE-2025-48954?

A vulnerability has been identified in Discourse, an open-source discussion platform, affecting versions prior to 3.5.0.beta6. This risk arises when the content security policy is not enabled for users authenticating via social logins, potentially allowing malicious scripts to be executed. To mitigate this issue, users are advised to update to version 3.5.0.beta6 or enable the content security policy as a workaround. Ensuring effective security measures is crucial for safeguarding user data.

References