PT-2025-28222 · Giscus · Giscus

Maxchang3 · Published 2025-07-07 · Updated 2025-07-07 · CVE-2025-53532

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: giscus (affected versions not specified)

Description: A bug in giscus' discussions creation API allowed an unauthorized user to create discussions on any repository where giscus is installed. This affects the server-side part of giscus, which is provided via http://giscus.app or your own self-hosted service.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-53532

GHSA-W6VG-V24F-4VM3

Affected Products

Giscus

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53532.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-53532 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53532 · Security Note
• https://github.com/giscus/giscus/commit/c43af7806e65adfcf4d0feeebef76dc36c95cb9a · Note
• https://github.com/giscus/giscus/security/advisories/GHSA-w6vg-v24f-4vm3 · Note
• https://github.com/giscus/giscus/commit/4b9745fe1a326ce08d69f8a388331bc993d19389 · Note
• https://twitter.com/VulmonFeeds/status/1942289148276076930 · Twitter Post
• https://twitter.com/CVEnew/status/1942276674701386213 · Twitter Post