PT-2025-20284 · Discourse · Discourse Code Review Plugin

Lillinator · Published 2025-05-07 · Updated 2025-08-20 · CVE-2025-46824

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse Code Review Plugin versions prior to commit eed3a80

Description The issue allows an attacker to execute arbitrary JavaScript on users' browsers by posting links to malicious GitHub commits. This is a problem with the Discourse Code Review Plugin, which enables users to review GitHub commits on Discourse.

Recommendations For versions prior to commit eed3a80, update to a version that includes commit eed3a80 to resolve the issue. As a temporary workaround, consider disabling the Discourse Code Review Plugin until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-46824

GHSA-358V-CWVC-GXH5

Affected Products

Discourse Code Review Plugin

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46824.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-46824 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46824 · Security Note
• https://github.com/discourse/discourse-code-review/commit/eed3a801f8fee217fe782212d8950eb1bd236e43 · Note
• https://github.com/discourse/discourse-code-review/security/advisories/GHSA-358v-cwvc-gxh5 · Note
• https://t.me/cvedetector/24742 · Telegram Post
• https://t.me/cveNotify/132942 · Telegram Post
• https://vicarius.io/vsociety/posts/cve-2025-46824-detect-discourse-plugin-vulnerability · Note
• https://twitter.com/CVEnew/status/1920246403370004752 · Twitter Post
• https://t.me/cvetracker/23287 · Telegram Post
• https://vicarius.io/vsociety/posts/cve-2025-46824-mitigate-discourse-plugin-vulnerability · Note