PT-2025-28222 · Giscus · Giscus

Maxchang3 · Publicado 2025-07-07 · Atualizado 2025-07-07 · CVE-2025-53532

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: giscus (affected versions not specified)

Description: A bug in giscus' discussions creation API allowed an unauthorized user to create discussions on any repository where giscus is installed. This affects the server-side part of giscus, which is provided via http://giscus.app or your own self-hosted service.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

CVE-2025-53532

GHSA-W6VG-V24F-4VM3

Produtos afetados

Giscus

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53532.json · Exploit
• https://github.com/giscus/giscus/commit/c43af7806e65adfcf4d0feeebef76dc36c95cb9a · Nota
• https://github.com/giscus/giscus/security/advisories/GHSA-w6vg-v24f-4vm3 · Nota
• https://github.com/giscus/giscus/commit/4b9745fe1a326ce08d69f8a388331bc993d19389 · Nota
• https://osv.dev/vulnerability/CVE-2025-53532 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-53532 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1942289148276076930 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1942276674701386213 · Publicação no Twitter