CVE-2025-48877: Discourse vulnerable to auto-executing of third-party code in embedded CodePen iframe
Discourse is an open-source discussion platform. Prior to version 3.4.4 of the stable branch, version 3.5.0.beta5 of the beta branch, and version 3.5.0.beta6-dev of the tests-passed branch, Codepen is present in the default allowediframes site setting, and it can potentially auto-run arbitrary JS in the iframe scope, which is unintended. This issue is patched in version 3.4.4 of the stable branch, version 3.5.0.beta5 of the beta branch, and version 3.5.0.beta6-dev of the tests-passed branch. As a workaround, the Codepen prefix can be removed from a site's allowediframes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48877?
CVE-2025-48877 has been classified with a severity level indicating potential risk due to improper handling of iframes.
How do I fix CVE-2025-48877?
To mitigate CVE-2025-48877, upgrade to Discourse version 3.4.4 or later for the stable branch, or 3.5.0.beta5 or later for the beta branches.
What versions of Discourse are affected by CVE-2025-48877?
CVE-2025-48877 affects Discourse versions prior to 3.4.4 in the stable branch and versions prior to 3.5.0.beta5 in the beta branch.
Is there a workaround for CVE-2025-48877 until I can update?
Disabling Codepen in the allowed_iframes site setting serves as a temporary workaround for CVE-2025-48877.
What components of Discourse are impacted by CVE-2025-48877?
CVE-2025-48877 impacts the iframe handling feature within Discourse, specifically related to the default allowed_iframes setting.