PT-2025-2952 · Discourse · Discourse

Jomaxro · Published 2025-02-04 · Updated 2025-09-25 · CVE-2024-53266

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest version of Discourse core

Description Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled, activity streams in the user's profile page may be vulnerable to XSS.

Recommendations For versions prior to the latest version of Discourse core, update to the latest version of Discourse core. For users unable to upgrade, ensure CSP is enabled.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-DISCOURSE-2024-53266

CVE-2024-53266

GHSA-HW4J-4HG7-22H2

Affected Products

Discourse

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53266.json · Exploit
• https://osv.dev/vulnerability/BIT-discourse-2024-53266 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-53266 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53266 · Security Note
• https://github.com/discourse/discourse/security/advisories/GHSA-hw4j-4hg7-22h2 · Note
• https://t.me/cveNotify/136454 · Telegram Post
• https://twitter.com/CVEnew/status/1886891652817830229 · Twitter Post
• https://t.me/cvedetector/17246 · Telegram Post
• https://t.me/cveNotify/133511 · Telegram Post