CVE-2025-54411
BaseFortify
Publication date: 2025-08-19
Last updated on: 2025-08-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | to 3.5.0 (exc) |
| discourse | discourse | 3.5.0 |
| discourse | discourse | 3.5.0 |
| discourse | discourse | 3.5.0 |
| discourse | discourse | 3.5.0 |
| discourse | discourse | 3.5.0 |
| discourse | discourse | 3.5.0 |
| discourse | discourse | 3.5.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-54411 is a low-severity Cross-Site Scripting (XSS) vulnerability in the Discourse platform's welcome banner user name string for logged-in users. The vulnerability occurs because the welcome banner does not properly sanitize special characters in the user's preferred display name, allowing malicious scripts to be injected and executed in the context of the affected user or an admin impersonating them. This can lead to unauthorized actions or data disclosure limited to the affected user session. The issue is fixed starting from Discourse version 3.5.0.beta8. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker with low privileges (a logged-in user) to inject malicious scripts into the welcome banner's user name display. When the victim user or an admin impersonating that user views the banner, the malicious script can execute, potentially leading to unauthorized actions or disclosure of information within that user session. However, the impact is limited to confidentiality and integrity at a low level and does not affect system availability. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if your Discourse instance is running a version up to and including 3.5.0.beta7-dev, which is vulnerable. Additionally, you can test if the welcome banner improperly renders user display names containing HTML or script tags by setting a test user display name with malicious HTML (e.g., <input type='text'></input>Test) and observing if the welcome banner renders the HTML instead of sanitizing it. There are no specific network commands for detection since this is a local XSS vulnerability affecting the web interface rendering. Detection involves verifying the version and testing the welcome banner rendering behavior. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include temporarily modifying the site text for 'welcome_banner.header.logged_in_members' to remove the 'preferred_display_name' placeholder, which prevents rendering of potentially malicious user display names in the welcome banner. Additionally, administrators should avoid impersonating users until the Discourse instance is updated to version 3.5.0.beta8 or later, where the vulnerability is fixed. [1]