Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, certain invites via email may result in HTML injection in the email body if the topic title includes HTML. This includes inviting someone (without an account) to a PM and inviting someone (without an account) to a topic with a custom message. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. This can be worked around if the relevant templates are overridden without `{topic_title}`.
References
| Link | Resource |
|---|---|
| https://github.com/discourse/discourse/security/advisories/GHSA-x8mp-chx3-6x2p | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
25 Aug 2025, 15:07
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/discourse/discourse/security/advisories/GHSA-x8mp-chx3-6x2p - Vendor Advisory | |
| First Time |
Discourse
Discourse discourse |
|
| CPE | cpe:2.3:a:discourse:discourse:3.5.0:beta4:*:*:beta:*:*:* cpe:2.3:a:discourse:discourse:3.5.0:beta2:*:*:beta:*:*:* cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:* cpe:2.3:a:discourse:discourse:3.5.0:beta3:*:*:beta:*:*:* cpe:2.3:a:discourse:discourse:3.5.0:-:*:*:beta:*:*:* cpe:2.3:a:discourse:discourse:3.5.0:beta1:*:*:beta:*:*:* cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:* |
12 Jun 2025, 16:06
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-06-09 13:15
Updated : 2025-08-25 15:07
NVD link : CVE-2025-48062
Mitre link : CVE-2025-48062
CVE.ORG link : CVE-2025-48062
JSON object : View
Products Affected
discourse
- discourse