UpHeron
All vulnerabilities

Servers and applications

CVE-2025-67723

Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have a content-security-policy-mitigated cross-site scriptinv vulnerability on the Discourse Math plugin when using its KaTeX variant. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, the Discourse Math plugin can be disabled, or the Mathjax…

Severity
Medium 5.4
Published
28 Jan 2026
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.5.4, 2025.11.2
Sources
NVD

Affected software

SoftwareAffected versions
DiscourseServers and applications · cpe:a:discourse:discourse
  • Every version before 3.5.4
  • From 2025.11.0 before 2025.11.2
  • Version 2025.12.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-67723
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-67723