High · published June 9, 2025
⚡ So close to a magical platform, but a sneaky iframe could let bad JavaScript slip right in! Before you know it, Codepen could run code you didn't intend it to. 🔥 Think of Discourse as a cozy café where the barista serves up delicious conversations. However, leaving an open window could let in a mischievous raccoon who tosses around unwanted ingredients in the café's recipes! If exploited, attackers could inject and execute any JavaScript within the iframe, potentially compromising user session data, altering content, or even redirecting users elsewhere - chaos in your cozy café! This vulnerability could lead to a serious breach of trust on your platform.
Think of Discourse as a cozy café where the barista serves up delicious conversations. However, leaving an open window could let in a mischievous raccoon who tosses around unwanted ingredients in the café's recipes! This vulnerability arises because Codepen is included in the default `allowed_iframes` settings, allowing it to auto-run arbitrary JavaScript, which can lead to unauthorized actions in the context of your site. The risk is amplified because it’s part of the stable and beta branches of Discourse before the patch.
If exploited, attackers could inject and execute any JavaScript within the iframe, potentially compromising user session data, altering content, or even redirecting users elsewhere - chaos in your cozy café! This vulnerability could lead to a serious breach of trust on your platform. To protect your community, immediately update Discourse to version 3.4.4 (stable), 3.5.0.beta5 (beta), or 3.5.0.beta6-dev (tests-passed). Alternatively, you can manually remove the Codepen prefix from your site’s `allowed_iframes` setting as a temporary workaround. You've got this! Follow these steps, and you’ll be safeguarding your community in no time! 🛡️