CVE-2025-48877
📋 TL;DR
This vulnerability in Discourse allows attackers to execute arbitrary JavaScript within iframes when Codepen is included in the allowed_iframes setting. It affects all Discourse instances using vulnerable versions, potentially enabling cross-site scripting attacks against users viewing malicious content.
💻 Affected Systems
- Discourse
📦 What is this software?
Discourse by Discourse
Discourse by Discourse
Discourse by Discourse
Discourse by Discourse
Discourse by Discourse
Discourse by Discourse
⚠️ Risk & Real-World Impact
Worst Case
Attackers could execute arbitrary JavaScript in users' browsers, leading to session hijacking, credential theft, or complete account compromise.
Likely Case
Cross-site scripting attacks that steal session cookies or perform unauthorized actions on behalf of authenticated users.
If Mitigated
Limited impact with proper content security policies and iframe sandboxing, though some risk remains.
🎯 Exploit Status
Exploitation requires user interaction (viewing malicious content) but no authentication
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Stable: 3.4.4, Beta: 3.5.0.beta5, Tests-passed: 3.5.0.beta6-dev
Vendor Advisory: https://github.com/discourse/discourse/security/advisories/GHSA-cm93-6m2m-cjcv
Restart Required: Yes
Instructions:
1. Update Discourse to patched version using your deployment method (Docker, manual, etc.) 2. Restart the application 3. Verify version is updated
🔧 Temporary Workarounds
Remove Codepen from allowed_iframes
allRemove Codepen prefix from the allowed_iframes site setting to prevent exploitation
Navigate to Admin > Settings > allowed_iframes and remove any Codepen entries
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to restrict iframe execution
- Monitor for suspicious iframe usage and Codepen-related activity in logs
🔍 How to Verify
Check if Vulnerable:
Check Discourse version and verify if Codepen is in allowed_iframes settingCheck Version:
Check Discourse admin panel or run: docker exec discourse cat /app/VERSIONVerify Fix Applied:
Confirm version is patched and Codepen is removed from allowed_iframes or patched version prevents auto-execution📡 Detection & Monitoring
Log Indicators:
- Unusual iframe usage patterns
- Codepen-related iframe requests in access logs
Network Indicators:
- Unexpected iframe content loading from external domains
SIEM Query:
web_logs | where url contains "codepen.io" and user_agent contains discourse