Untriaged
Permalink
CVE-2025-67723
4.6 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): REQUIRED
- Scope (S): UNCHANGED
- Confidentiality impact (C): NONE
- Integrity impact (I): LOW
- Availability impact (A): LOW
Discourse vulnerable to stored Cross-site Scripting via Katex in discourse-math plugin
Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have a content-security-policy-mitigated cross-site scriptinv vulnerability on the Discourse Math plugin when using its KaTeX variant. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, the Discourse Math plugin can be disabled, or the Mathjax provider can be used instead of KaTeX.
References
-
https://github.com/discourse/discourse/security/advisories/GHSA-955h-m28g-5379 x_refsource_CONFIRM
Affected products
discourse
- ==>= 2026.1.0-latest, < 2026.1.0
- ==>= 2025.12.0-latest, < 2025.12.1
- ==>= 2025.11.0-latest, < 2025.11.2
- ==< 3.5.4
Matching in nixpkgs
pkgs.discourse
Discourse is an open source discussion platform
pkgs.discourseAllPlugins
Discourse is an open source discussion platform
pkgs.discourse-mail-receiver
Helper program which receives incoming mail for Discourse
pkgs.python312Packages.pydiscourse
Python library for working with Discourse
pkgs.python313Packages.pydiscourse
Python library for working with Discourse
Package maintainers
-
@talyz Kim Lindberger <kim.lindberger@gmail.com>
-
@nagisa Simonas Kazlauskas <nixpkgs@kazlauskas.me>
-
@Dettorer Paul Hervot <paul.hervot@dettorer.net>