Cross-Site Scripting Vulnerability in Discourse Math Plugin

CVE-2025-67723

What is CVE-2025-67723?

An open source discussion platform, Discourse, has revealed a vulnerability within its Math plugin, specifically affecting extensions using the KaTeX variant. This cross-site scripting flaw can potentially allow malicious users to execute scripts in users' browsers. It is crucial for users of Discourse to upgrade to versions 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0 to mitigate this risk. Alternatively, users can disable the Math plugin or utilize Mathjax as a safer provider.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References