CVE-2025-48877
BaseFortify
Publication date: 2025-06-09
Last updated on: 2025-09-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | to 3.4.4 (exc) |
| discourse | discourse | to 3.5.0 (exc) |
| discourse | discourse | 3.5.0 |
| discourse | discourse | 3.5.0 |
| discourse | discourse | 3.5.0 |
| discourse | discourse | 3.5.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1038 | The product uses a mechanism that automatically optimizes code, e.g. to improve a characteristic such as performance, but the optimizations can have an unintended side effect that might violate an intended security assumption. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Discourse platform involves the embedded CodePen iframe being included by default in the 'allowed_iframes' site setting in certain versions. This allows CodePen to potentially auto-run arbitrary JavaScript within the iframe scope without user consent, which is unintended behavior. It affects stable versions before 3.4.4, beta versions before 3.5.0.beta5, and tests-passed versions before 3.5.0.beta5. The issue is fixed by removing or updating the CodePen prefix in the allowed_iframes setting in patched versions. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing third-party CodePen content to automatically execute arbitrary JavaScript within the iframe scope on your Discourse site without explicit user consent. This could lead to unintended script execution, potentially compromising site security or user data depending on the malicious code run. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking the Discourse site's 'allowed_iframes' setting to see if it includes the CodePen prefix, which allows auto-running arbitrary JavaScript. There are no specific commands provided, but inspecting the site settings configuration or querying the Discourse database or admin interface for the 'allowed_iframes' value would help identify if CodePen is enabled. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, remove the CodePen prefix from the 'allowed_iframes' site setting in your Discourse installation. Alternatively, upgrade your Discourse instance to version 3.4.4 or later on the stable branch, 3.5.0.beta5 or later on the beta branch, or 3.5.0.beta6-dev or later on the tests-passed branch, where this issue is patched. [1]