PT-2025-40288 · Discourse · Discourse

Tgxworld · Published 2025-10-01 · Updated 2025-10-23 · CVE-2025-58054

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.1

Description Discourse, an open-source community discussion platform, is affected by a cross-site scripting (XSS) issue. The issue stems from how the platform parses and renders chat channel titles and chat thread titles using the quote message functionality with the rich text editor. This allows for the execution of malicious scripts through crafted titles.

Recommendations Update to version 3.5.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

BIT-DISCOURSE-2025-58054

CVE-2025-58054

GHSA-7P47-8M82-M2VF

Affected Products

Discourse

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58054.json · Exploit
• https://github.com/discourse/discourse/commit/3a224fd546d894ee408e7414b6879e814a792f91 · Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-7p47-8m82-m2vf · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2025-58054 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58054 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58054 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1973560654708584918 · Twitter Post
• https://twitter.com/CVEnew/status/1973469328038138336 · Twitter Post
• https://t.me/CVEtracker/33867 · Telegram Post
• https://t.me/cveNotify/140027 · Telegram Post