Description

The Discourse Code Review Plugin allows users to review GitHub commits on Discourse. Prior to commit eed3a80, an attacker can execute arbitrary JavaScript on users' browsers by posting links to malicious GitHub commits. This problem is patched in commit eed3a80 of the discourse-code-review plugin. As a workaround, one may disable the plugin.

INFO

Published Date :

2025-05-07T17:37:56.214Z

Last Modified :

2025-08-20T19:46:09.955Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2025-46824 vulnerability.

No data.

REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-46824.

URL Resource
https://github.com/discourse/discourse-code-review/commit/eed3a801f8fee217fe782212d8950eb1bd236e43 cve-icon cve-icon
https://github.com/discourse/discourse-code-review/security/advisories/GHSA-358v-cwvc-gxh5 cve-icon cve-icon
https://www.vicarius.io/vsociety/posts/cve-2025-46824-detect-discourse-plugin-vulnerability cve-icon
https://www.vicarius.io/vsociety/posts/cve-2025-46824-mitigate-discourse-plugin-vulnerability cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact