PT-2026-5181 · Discourse · Discourse+1

CVE-2025-67723 · Publicado 2026-01-28 · Atualizado 2026-02-09

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.4 Discourse versions prior to 2025.11.2 Discourse versions prior to 2025.12.1 Discourse versions prior to 2026.1.0

Description Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 contain a content-security-policy-mitigated cross-site scripting issue within the Discourse Math plugin when utilizing its KaTeX variant. The issue is addressed in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0.

Recommendations Discourse versions prior to 3.5.4: Upgrade to version 3.5.4 or later. Discourse versions prior to 2025.11.2: Upgrade to version 2025.11.2 or later. Discourse versions prior to 2025.12.1: Upgrade to version 2025.12.1 or later. Discourse versions prior to 2026.1.0: Upgrade to version 2026.1.0 or later. As a temporary workaround, disable the Discourse Math plugin. As a temporary workaround, use the Mathjax provider instead of KaTeX.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BIT-DISCOURSE-2025-67723

CVE-2025-67723

GHSA-955H-M28G-5379

Produtos afetados

Discourse

Discourse Math Plugin

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67723.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-955h-m28g-5379 · Aviso do Fabricante
• https://t.me/cveNotify/151451 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-67723 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-67723 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-discourse-2025-67723 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2016587742629519395 · Publicação no Twitter