Discourse EUVD-2025-17469

This vulnerability presents critical real-world risk validated by multiple signals: (1) CVSS 9.8 with AV:N/AC:L/PR:N/UI:N indicates maximum exploitability—network-accessible, low complexity, unauthenticated, no user interaction required; (2) Affects default configurations, meaning all unpatched Discourse instances are vulnerable out-of-the-box; (3) Attack surface is extremely broad—any forum user can post content embedding malicious Codepen iframes; (4) Impact is complete system compromise (Confidentiality/Integrity/Availability all HIGH); (5) No workaround removes the vulnerability entirely, only mitigates via manual configuration. This is not a high-CVSS-but-low-risk issue—it is a genuine critical vulnerability requiring emergency patching. EPSS exploitation probability would be expected to be high given the trivial attack requirements and default vulnerable state.

An attacker visits a vulnerable Discourse forum (default configuration, unpatched). Without authentication, the attacker creates or edits a post containing an embedded Codepen iframe with malicious JavaScript payload, such as: <iframe src='https://codepen.io/pen/?editors=0010&_x_tr_sl=auto' data-onload='malicious_js_here'></iframe>. When any forum visitor (including administrators) views the post, Codepen auto-executes the JavaScript in the user's browser context within the forum domain, allowing the attacker to steal session cookies, hijack accounts, modify forum content, escalate privileges to administrator, or inject malware for distribution. The attack requires zero user interaction beyond normal forum browsing, affects all visitors equally, and can propagate via quote-sharing of infected posts. No proof-of-concept publication is required due to the straightforward attack methodology.