CVE-2025-48062
Description
Discourse is an open-source discussion platform. Prior to version 3.4.4 of the stable branch, version 3.5.0.beta5 of the beta branch, and version 3.5.0.beta6-dev of the tests-passed branch, certain invites via email may result in HTML injection in the email body if the topic title includes HTML. This includes inviting someone (without an account) to a PM and inviting someone (without an account) to a topic with a custom message. This issue is patched in version 3.4.4 of the stable branch, version 3.5.0.beta5 of the beta branch, and version 3.5.0.beta6-dev of the tests-passed branch. This can be worked around if the relevant templates are overridden without {topic_title}.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
9cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*+ 7 more
- cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*range: <3.5.0
- cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*range: <3.4.4
- cpe:2.3:a:discourse:discourse:3.5.0:beta1:*:*:beta:*:*:*
- cpe:2.3:a:discourse:discourse:3.5.0:beta2:*:*:beta:*:*:*
- cpe:2.3:a:discourse:discourse:3.5.0:beta3:*:*:beta:*:*:*
- cpe:2.3:a:discourse:discourse:3.5.0:beta4:*:*:beta:*:*:*
- (no CPE)range: <3.4.4, <3.5.0.beta5, <3.5.0.beta6-dev
- (no CPE)range: < 3.4.4
Patches
Vulnerability mechanics
References
1- github.com/discourse/discourse/security/advisories/GHSA-x8mp-chx3-6x2pnvdVendor Advisory
News mentions
0No linked articles in our index yet.