Vulnerability Database

322,129

Total vulnerabilities in the database

CVE-2025-67723

Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have a content-security-policy-mitigated cross-site scriptinv vulnerability on the Discourse Math plugin when using its KaTeX variant. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, the Discourse Math plugin can be disabled, or the Mathjax provider can be used instead of KaTeX.

  • Published: Jan 28, 2026
  • Updated: Jan 29, 2026
  • CVE: CVE-2025-67723
  • Severity: Low
  • Exploit:

CVSS v3:

  • Severity: Low
  • Score: 4.6
  • AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

CWEs:

OWASP TOP 10:

Software From Fixed in
discourse / discourse - 3.5.4
discourse / discourse 2025.11.0 2025.11.2
discourse / discourse 2025.12.0 2025.12.0.x