CVE-2025-46824: Discourse Code Review Plugin vulnerable to XSS via auto link commits
First published: Wed May 07 2025(Updated: )
The Discourse Code Review Plugin allows users to review GitHub commits on Discourse. Prior to commit eed3a80, an attacker can execute arbitrary JavaScript on users' browsers by posting links to malicious GitHub commits. This problem is patched in commit eed3a80 of the discourse-code-review plugin. As a workaround, one may disable the plugin.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Discourse Code Review Plugin | <eed3a80 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-46824?
CVE-2025-46824 is classified as a security vulnerability that allows for the execution of arbitrary JavaScript on users' browsers.
How do I fix CVE-2025-46824?
To fix CVE-2025-46824, update the Discourse Code Review Plugin to the version including commit eed3a80.
What versions of the Discourse Code Review Plugin are affected by CVE-2025-46824?
CVE-2025-46824 affects all versions of the Discourse Code Review Plugin prior to commit eed3a80.
What type of attacks can be executed due to CVE-2025-46824?
CVE-2025-46824 allows attackers to post malicious links that execute arbitrary JavaScript in users' browsers.
Who is impacted by CVE-2025-46824?
Users of the Discourse Code Review Plugin prior to commit eed3a80 may be impacted by CVE-2025-46824.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/type
- agent/references
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/discourse
- canonical/discourse code review plugin