CVE-2025-53532

giscus is a commenting system powered by GitHub Discussions. A bug in giscus' discussions creation API allowed an unauthorized user to create discussions on any repository where giscus is installed. This affects the server-side part of giscus, which is provided via http://giscus.app or your own self-hosted service. This vulnerability is fixed by the c43af7806e65adfcf4d0feeebef76dc36c95cb9a and 4b9745fe1a326ce08d69f8a388331bc993d19389 commits.

• CWE-285

• https://github.com/giscus/giscus/commit/4b9745fe1a326ce08d69f8a388331bc993d19389
• https://github.com/giscus/giscus/commit/c43af7806e65adfcf4d0feeebef76dc36c95cb9a
• https://github.com/giscus/giscus/security/advisories/GHSA-w6vg-v24f-4vm3

Published

Jul 7, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-53527WeGIA is a web manager for charitable institutions. A Time-B…9.8
• CVE-2025-53528Cadwyn creates production-ready community-driven modern Stri…7.6
• CVE-2025-53529WeGIA is a web manager for charitable institutions. An SQL I…9.8
• CVE-2025-5353A hardcoded key in Ivanti Workspace Control before version 1…7.8
• CVE-2025-53530WeGIA is a web manager for charitable institutions. The Wegi…7.5
• CVE-2025-53531WeGIA is a web manager for charitable institutions. The Wegi…7.5
• CVE-2025-53533Pi-hole Admin Interface is a web interface for managing Pi-h…6.1
• CVE-2025-53534RatPanel is a server operation and maintenance management pa…7.7
• CVE-2025-53535Better Auth is an authentication and authorization library f…2.1
• CVE-2025-53536Roo Code is an AI-powered autonomous coding agent. Prior to …8.1
• CVE-2025-53537LibHTP is a security-aware parser for the HTTP protocol and …7.5
• CVE-2025-53538Suricata is a network IDS, IPS and NSM engine developed by t…7.5