CVE-2025-46824CWE-79

Discourse Code Review Plugin vulnerable to XSS via auto link commits

Low · published May 7, 2025

CVSS v3.1
3.1
EPSS
0%
Percentile
26.1
In the wild
Unconfirmed
What it is

The Discourse Code Review Plugin allows users to review GitHub commits on Discourse. Prior to commit eed3a80, an attacker can execute arbitrary JavaScript on users' browsers by posting links to malicious GitHub commits. This problem is patched in commit eed3a80 of the discourse-code-review plugin. As a workaround, one may disable the plugin.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00339 · 26.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-05-07T17:37Z
EPSS history
Timeline
  • 07 MAY 17:37Z
    Discourse Code Review Plugin vulnerable to XSS via auto link commits
    cvelistv5