VulnerabilityDeferred
CVE-2025-46824
The Discourse Code Review Plugin allows users to review GitHub commits on Discourse.
LOW 3.1EPSS 0.33%
Does this matter?
Lower severity and a low EPSS score (0.33%). Track it; it rarely justifies an emergency change on its own.
Description
The Discourse Code Review Plugin allows users to review GitHub commits on Discourse. Prior to commit eed3a80, an attacker can execute arbitrary JavaScript on users' browsers by posting links to malicious GitHub commits. This problem is patched in commit eed3a80 of the discourse-code-review plugin. As a workaround, one may disable the plugin.
- CVSS 3.1
- 3.1 LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.33% probability · 25th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Source
- security-advisories@github.com
References
- https://github.com/discourse/discourse-code-review/commit/eed3a801f8fee217fe782212d8950eb1bd236e43
- https://github.com/discourse/discourse-code-review/security/advisories/GHSA-358v-cwvc-gxh5
- https://www.vicarius.io/vsociety/posts/cve-2025-46824-detect-discourse-plugin-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-46824-mitigate-discourse-plugin-vulnerability
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.