CVE-2025-58054

{
  "id": "CVE-2025-58054",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-01T19:15:36.150",
  "lastModified": "2026-10-19T17:10:00.173",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Discourse is an open-source community discussion platform. Versions 3.5.0 and below are vulnerable to XSS attacks through parsing and rendering of chat channel titles and chat thread titles via the quote message functionality when using the rich text editor. This issue is fixed in version 3.5.1."
    },
    {
      "lang": "es",
      "value": "Discourse es una plataforma de discusión comunitaria de código abierto. Las versiones 3.5.0 e inferiores son vulnerables a ataques XSS a través del análisis y la representación de títulos de canales de chat y títulos de hilos de chat mediante la funcionalidad de citar mensajes al usar el editor de texto enriquecido. Este problema está solucionado en la versión 3.5.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "discourse",
          "product": "discourse",
          "versions": [
            {
              "version": "< 3.5.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
          "baseScore": 3.5,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 1.4
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-01T19:03:59.856488Z",
          "id": "CVE-2025-58054",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*",
              "versionEndExcluding": "3.5.0",
              "matchCriteriaId": "2923F397-B2C7-43C8-8DDF-CA59D6B27774"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*",
              "versionEndExcluding": "3.6.0",
              "matchCriteriaId": "4C433F55-3787-4B9E-8028-ED55F6B9056B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:discourse:discourse:3.6.0:beta1:*:*:beta:*:*:*",
              "matchCriteriaId": "C11E39E0-7F3D-4DBA-A8AD-7440BCEBB984"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/discourse/discourse/commit/3a224fd546d894ee408e7414b6879e814a792f91",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/discourse/discourse/security/advisories/GHSA-7p47-8m82-m2vf",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}