Discourse EUVD-2025-33227

Requires the Discourse chat plugin to be enabled (and, for the thread-title variant, threading_enabled on the channel); the attacker needs an authenticated account able to set a chat channel name or create/name a chat thread, and must inject an HTML payload into that title. The victim must actively invoke the quote-message functionality in the rich text editor, which renders the attacker-controlled title via emojiUnescape without sanitization. Key limiting factor: the fix's regression tests disable Content Security Policy to make the payload fire, indicating that Discourse's default CSP likely blocks inline script execution and materially constrains real-world exploitation; affected only on versions 3.5.0 and below.

This is a medium-severity stored/DOM XSS (CVSS 5.4, CWE-80) whose signals consistently point to LOW real-world urgency rather than an active priority. EPSS is 0.03% (10th percentile), there is no CISA KEV listing, and no public exploit code was identified - only vendor-authored regression tests in the fix commit demonstrate the vector. The NVD vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) lists PR:N, but this CONFLICTS with the actual mechanism: an attacker must be able to set a chat channel or thread title, which requires an authenticated account with chat access - so the realistic privilege requirement is PR:L, not PR:N (verify with vendor). Exploitation also requires victim interaction (UI:R) via the quote-message feature and the chat plugin being enabled. Notably, the fix's test suite explicitly disables Content Security Policy (SiteSetting.content_security_policy = false) to observe the payload firing, strongly implying Discourse's default CSP mitigates inline script execution in production - further reducing real risk. Net: a genuine but low-priority flaw best handled via routine patching to 3.5.1.

An authenticated user with chat access sets a chat channel or thread title containing an HTML/JS payload (e.g. '<video src=_ onloadstart=confirm(document.domain)>'). When another user quotes a chat message containing that title into the rich text editor, the title is passed through emojiUnescape and rendered as raw innerHTML without sanitization, executing attacker-controlled JavaScript in the victim's browser. No public POC was identified, though the vendor's fix commit includes test cases that reproduce the vector.