What is the CVSS score of CVE-2025-48877?

CVE-2025-48877 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Discourse are affected by CVE-2025-48877?

Discourse versions before 3.4.4 contain a critical unauthenticated remote code execution vulnerability affecting all default installations.. A patch is available.

How to fix or mitigate CVE-2025-48877?

Within 24 hours: Identify all Discourse instances and their current versions via admin dashboard. If running versions prior to 3.4.4 (stable), 3.5.0.beta5 (beta), or 3.5.0.beta6-dev (tests-passed), isolate affected instances from production traffic if possible. Within 7 days: Apply Discourse vendor patch to version 3.4.4 stable or later, or 3.5.0.beta5/beta6-dev or later for beta deployments. Test patches in staging environment before production rollout. Within 30 days: Audit forum posts and user content created during vulnerability window for malicious Codepen embeds; review access logs for exploitation attempts; implement content security policy enhancements to restrict iframe execution.

Discourse CVE-2025-48877

EUVD-2025-17469 CRITICAL

Insecure Automated Optimizations (CWE-1038)

2025-06-09 security-advisories@github.com

RCE Discourse

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:55 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.4.4,3.5.0.beta5,3.5.0.beta6-dev

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17469

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 13:15 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Discourse is an open-source discussion platform. Prior to version 3.4.4 of the stable branch, version 3.5.0.beta5 of the beta branch, and version 3.5.0.beta6-dev of the tests-passed branch, Codepen is present in the default allowed_iframes site setting, and it can potentially auto-run arbitrary JS in the iframe scope, which is unintended. This issue is patched in version 3.4.4 of the stable branch, version 3.5.0.beta5 of the beta branch, and version 3.5.0.beta6-dev of the tests-passed branch. As a workaround, the Codepen prefix can be removed from a site's allowed_iframes.

AnalysisAI

Discourse versions prior to 3.4.4 (stable), 3.5.0.beta5 (beta), and 3.5.0.beta6-dev (tests-passed) contain a critical vulnerability where Codepen is included in the default allowed_iframes site setting and can auto-execute arbitrary JavaScript within the iframe scope, enabling unauthenticated remote code execution. With a CVSS score of 9.8 and network-accessible attack vector requiring no privileges or user interaction, this vulnerability poses severe risk to all default Discourse installations and should be prioritized for immediate patching.

Technical ContextAI

Discourse's allowed_iframes site setting controls which external domains can be embedded as iframes within forum content. Codepen embeds were included in the default allowlist to enable code snippet sharing. The vulnerability arises from CWE-1038 (Improper Restriction of Rendered UI Layers or Frames), where Codepen's iframe implementation can auto-execute JavaScript payloads passed via iframe attributes or URL parameters, bypassing expected sandbox restrictions. This occurs because Codepen does not enforce strict content security policies or sandbox attribute restrictions that would prevent script execution. The issue affects all installations using default site settings without explicit configuration changes, impacting deployments across CPE:2.3:a:discourse:discourse:*:*:*:*:*:*:*:* where version < 3.4.4 (stable branch).

RemediationAI

Upgrade to patched versions immediately; versions: ['3.4.4 or later (stable branch)', '3.5.0.beta5 or later (beta branch)', '3.5.0.beta6-dev or later (tests-passed branch)']; instructions: Apply security update through standard Discourse update mechanism or Docker image refresh Workaround: Remove Codepen from allowed_iframes site setting; instructions: Navigate to Admin > Settings > Security > allowed_iframes and remove any Codepen domain entries (codepen.io, *.codepen.io, etc.) until patch is applied; effectiveness: Prevents exploitation but removes Codepen embedding functionality Monitoring: Audit existing forum content for malicious Codepen embeds; instructions: Search post content database for Codepen iframe references created by untrusted users during vulnerable period; review access logs for suspicious activity