PT-2026-5181 · Discourse · Discourse+1

Published 2026-01-28 · Updated 2026-02-09 · CVE-2025-67723

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.4 Discourse versions prior to 2025.11.2 Discourse versions prior to 2025.12.1 Discourse versions prior to 2026.1.0

Description Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 contain a content-security-policy-mitigated cross-site scripting issue within the Discourse Math plugin when utilizing its KaTeX variant. The issue is addressed in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0.

Recommendations Discourse versions prior to 3.5.4: Upgrade to version 3.5.4 or later. Discourse versions prior to 2025.11.2: Upgrade to version 2025.11.2 or later. Discourse versions prior to 2025.12.1: Upgrade to version 2025.12.1 or later. Discourse versions prior to 2026.1.0: Upgrade to version 2026.1.0 or later. As a temporary workaround, disable the Discourse Math plugin. As a temporary workaround, use the Mathjax provider instead of KaTeX.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-DISCOURSE-2025-67723

CVE-2025-67723

GHSA-955H-M28G-5379

Affected Products

Discourse

Discourse Math Plugin

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67723.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-955h-m28g-5379 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-67723 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67723 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2025-67723 · Vendor Advisory
• https://t.me/cveNotify/151451 · Telegram Post
• https://twitter.com/CVEnew/status/2016587742629519395 · Twitter Post