PT-2025-24434 · Codepen+1 · Codepen+1

Lowtgxworld · Published 2025-06-09 · Updated 2025-06-11 · CVE-2025-48877

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.4.4 Discourse version 3.5.0.beta5 and earlier of the beta branch Discourse version 3.5.0.beta6-dev and earlier of the tests-passed branch

Description Discourse is an open-source discussion platform. In versions prior to the fixed ones, Codepen is present in the default site setting allowed iframes and can potentially auto-run arbitrary JavaScript code in the iframe scope, which is unintended.

Recommendations For Discourse versions prior to 3.4.4, update to version 3.4.4 or later. For Discourse version 3.5.0.beta5 and earlier of the beta branch, update to a version later than 3.5.0.beta5. For Discourse version 3.5.0.beta6-dev and earlier of the tests-passed branch, update to a version later than 3.5.0.beta6-dev. As a temporary workaround for all affected versions, consider removing the Codepen prefix from the site's allowed iframes setting to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-1038

Related Identifiers

BIT-DISCOURSE-2025-48877

CVE-2025-48877

GHSA-CM93-6M2M-CJCV

Affected Products

Codepen

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48877.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-cm93-6m2m-cjcv · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2025-48877 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48877 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48877 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1932103354206884075 · Twitter Post
• https://t.me/cvetracker/25780 · Telegram Post
• https://t.me/latest_high_impact_cve/2592 · Telegram Post