Vulnerability · Published Aug 19, 2025 · Assigned by GitHub_M

CVE-2025-54411Discourse welcome banner user name XSS

Low 2.4

In plain English

A low-severity cross-site scripting in discourse from discourse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 4.0)2.4Low

Exploit odds (30 days)0.2%top 89.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcome_banner.header.logged_in_members site text to remove the preferred_display_name placeholder, or not impersonate any users for the time being. This vulnerability is fixed in 3.5.0.beta8.

Affected products (as reported)

Vendor	Product	Versions
discourse	discourse	< 3.5.0.beta8

Weakness: CWE-79 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/discourse/discourse/security/advisories/GHSA-5mm6-j5vq-6884 x_refsource_CONFIRM
https://github.com/discourse/discourse/commit/a3374d2850f07444d113216e1d539ee21650dbff x_refsource_MISC