CVE-2025-58054

CVE-2025-58054 refers to a Discourse XSS vulnerability present in versions ≤ 3.5.0, triggered by parsing/rendering chat channel titles and chat thread titles via the quote message feature in the rich text editor. The issue is resolved in version 3.5.1. Affected product: Discourse open-source plat...

CVE-2025-58054 Discourse is vulnerable to XSS when quoting chat messages

Discourse is an open-source community discussion platform. Versions 3.5.0 and below are vulnerable to XSS attacks through parsing and rendering of chat channel titles and chat thread titles via the quote message functionality when using the rich text editor. This issue is fixed in version 3.5.1...

CVE-2025-59337: Improper Neutralization of Special Elements used in a Command

Discourse is an open-source community discussion platform. In versions 3.5.0 and below, malicious meta-commands could be embedded in a backup dump and executed during restore. In multisite setups, this allowed an admin of one site to access data or credentials from other sites. This issue is fixe...

Discourse command injection vulnerability

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes features such as communities, email and chat rooms. A command injection vulnerability exists in Discourse 3.5.0 and prior versions, which stems from a malicious meta-command that can be...

PT-2025-40301

Name of the Vulnerable Software and Affected Versions Discourse versions 3.5.0 and below Description Discourse is a community discussion platform. A flaw exists where malicious meta-commands could be placed within a backup dump and then executed during the restore process. In environments with...

CVE-2025-58055: Improper Access Control

Discourse is an open-source community discussion platform. In versions 3.5.0 and below, the Discourse AI suggestion endpoints for topic “Title”, “Category”, and “Tags” allowed authenticated users to extract information about topics that they weren’t authorized to access. By modifying the “topicid...

CVE-2025-58054: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Discourse is an open-source community discussion platform. Versions 3.5.0 and below are vulnerable to XSS attacks through parsing and rendering of chat channel titles and chat thread titles via the quote message functionality when using the rich text editor. This issue is fixed in version 3.5.1...

PT-2025-40288

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.1 Description Discourse, an open-source community discussion platform, is affected by a cross-site scripting XSS issue. The issue stems from how the platform parses and renders chat channel titles and chat threa...

Discourse security vulnerabilities

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes features such as communities, email, and chat rooms. A security vulnerability exists in Discourse 3.5.0 and earlier versions, which stems from an AI suggestion endpoint that does not proper...

PT-2025-40289

Name of the Vulnerable Software and Affected Versions Discourse versions 3.5.0 and below Description Discourse, an open-source community discussion platform, had an issue where authenticated users could access information about topics they were not authorized to view. This occurred through the AI...

Discourse security vulnerabilities

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes features such as communities, email and chat rooms. A security vulnerability exists in Discourse 3.5.0 and earlier versions, which stems from the ease of parsing and rendering chat channel...

CVE-2025-54411

Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcomebanner.header.loggedinmembers site text to remove the...

BIT-DISCOURSE-2025-54411 Discourse welcome banner user name XSS

Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcomebanner.header.loggedinmembers site text to remove the...

CVE-2025-54411

Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcomebanner.header.loggedinmembers site text to remove the...

CVE-2025-54411 Discourse welcome banner user name XSS

Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcomebanner.header.loggedinmembers site text to remove the...

CVE-2025-54411 Discourse welcome banner user name XSS

Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcomebanner.header.loggedinmembers site text to remove the...

CVE-2025-54411

CVE-2025-54411 affects Discourse prior to 3.5.0.beta8, where the welcome_banner.header.logged_in_members and the logged-in user name string can cause cross-site scripting (XSS). The underlying issue is in the welcome banner user name string, enabling XSS that may impact the user or allow an admin...

PT-2025-33751 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.5.0.beta8 Description: Discourse, an open-source discussion platform, contains a cross-site scripting XSS issue in the welcome banner user name string for logged-in users. This can affect the user or an...

Discourse cross-site scripting vulnerabilities

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes community, email, and chat room features. Discourse suffers from a cross-site scripting vulnerability that stems from a cross-site scripting attack in which an unescaped username string is...

CVE-2025-54411: Improper Neutralization of Input During Web Page Generation

Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcomebanner.header.loggedinmembers site text to remove the...