CVE-2025-22602

Discourse is an open source platform for community discussion. In affected versions an attacker can execute arbitrary JavaScript on users' browsers by posting a malicious video placeholder html element. This issue only affects sites with CSP disabled. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should enable CSP.

• CWE-79

• https://github.com/discourse/discourse/security/advisories/GHSA-jcjx-694p-c5m3Third Party Advisory

Published

Feb 4, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-22597WeGIA is a web manager for charitable institutions. A Stored…6.1
• CVE-2025-22598WeGIA is a web manager for charitable institutions. A Stored…6.1
• CVE-2025-22599WeGIA is a web manager for charitable institutions. A Reflec…6.5
• CVE-2025-2260In NetX HTTP server functionality of Eclipse ThreadX NetX Du…7.5
• CVE-2025-22600WeGIA is a web manager for charitable institutions. A Reflec…6.5
• CVE-2025-22601Discourse is an open source platform for community discussio…3.1
• CVE-2025-22603AutoGPT is a platform that allows users to create, deploy, a…8.1
• CVE-2025-22604Cacti is an open source performance and fault management fra…7.2
• CVE-2025-22605Coolify is an open-source and self-hostable tool for managin…7.8
• CVE-2025-22606Coolify is an open-source and self-hostable tool for managin…7.8
• CVE-2025-22607Coolify is an open-source and self-hostable tool for managin…5.5
• CVE-2025-22608Coolify is an open-source and self-hostable tool for managin…6.5