CVE-2025-67723

Description

Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have a content-security-policy-mitigated cross-site scriptinv vulnerability on the Discourse Math plugin when using its KaTeX variant. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, the Discourse Math plugin can be disabled, or the Mathjax provider can be used instead of KaTeX.

PUBLISHED Reserved 2025-12-10 | Published 2026-01-28 | Updated 2026-01-28 | Assigner GitHub_M

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

References

github.com/...course/security/advisories/GHSA-955h-m28g-5379

cve.org (CVE-2025-67723)

nvd.nist.gov (CVE-2025-67723)

Download JSON