CVE-2025-48877 - Discourse vulnerable to auto-executing of third-party code in embedded CodePen iframe

Back Back to CVE browser

HIGH

Discourse vulnerable to auto-executing of third-party code in embedded CodePen iframe

Published Jun 9, 2025

8.1

HIGH

CVSS 4.0

EPSS 0.41%

Description

Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, Codepen is present in the default `allowed_iframes` site setting, and it can potentially auto-run arbitrary JS in the iframe scope, which is unintended. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. As a workaround, the Codepen prefix can be removed from a site's `allowed_iframes`.

Affected products

Vendor Discourse Product Discourse Default
n/a
- Version
  < 3.4.4
  Status
  affected
  Constraints
  -
- Version
  < 3.5.0.beta5
  Status
  affected
  Constraints
  -
- Version
  < 3.5.0.beta6-dev
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Discourse

n/a

Version	Status	Constraints
< 3.4.4	affected	-
< 3.5.0.beta5	affected	-
< 3.5.0.beta6-dev	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-1038

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-17469
Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-cm93-6m2m-cjcv
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-17469		Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-cm93-6m2m-cjcv		x_refsource_CONFIRMVendor Advisory