PT-2025-4590 · Discourse · Discourse

Taisehub · Published 2025-02-04 · Updated 2025-09-26 · CVE-2025-22602

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest version

Description Discourse is an open source platform for community discussion. In affected versions, an attacker can execute arbitrary JavaScript on users' browsers by posting a malicious video placeholder HTML element. This issue only affects sites with CSP disabled.

Recommendations For versions prior to the latest version, update to the latest version to resolve the issue. As a temporary workaround for users unable to upgrade, enable CSP to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-DISCOURSE-2025-22602

CVE-2025-22602

GHSA-JCJX-694P-C5M3

Affected Products

Discourse

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22602.json · Exploit
• https://osv.dev/vulnerability/BIT-discourse-2025-22602 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22602 · Security Note
• https://osv.dev/vulnerability/CVE-2025-22602 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-jcjx-694p-c5m3 · Note
• https://t.me/cvedetector/17253 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1886999488247549992 · Twitter Post
• https://t.me/cveNotify/136546 · Telegram Post
• https://twitter.com/CVEnew/status/1886885701653811239 · Twitter Post
• https://twitter.com/bluepinksec/status/1887033709506773041 · Twitter Post