{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-02T12:06:11.243","vulnerabilities":[{"cve":{"id":"CVE-2025-67723","sourceIdentifier":"security-advisories@github.com","published":"2026-01-28T19:16:22.640","lastModified":"2026-06-17T09:58:02.120","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have a content-security-policy-mitigated cross-site scriptinv vulnerability on the Discourse Math plugin when using its KaTeX variant. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, the Discourse Math plugin can be disabled, or the Mathjax provider can be used instead of KaTeX."},{"lang":"es","value":"Discourse es una plataforma de discusión de código abierto. Las versiones anteriores a 3.5.4, 2025.11.2, 2025.12.1 y 2026.1.0 tienen una vulnerabilidad de scripting entre sitios mitigada por política de seguridad de contenido en el plugin Discourse Math cuando se utiliza su variante KaTeX. Este problema está parcheado en las versiones 3.5.4, 2025.11.2, 2025.12.1 y 2026.1.0. Como solución alternativa, se puede deshabilitar el plugin Discourse Math, o se puede usar el proveedor Mathjax en lugar de KaTeX."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"discourse","product":"discourse","versions":[{"version":"< 3.5.4","status":"affected"},{"version":">= 2025.11.0-latest, < 2025.11.2","status":"affected"},{"version":">= 2025.12.0-latest, < 2025.12.1","status":"affected"},{"version":">= 2026.1.0-latest, < 2026.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.1,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-28T19:05:28.048224Z","id":"CVE-2025-67723","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*","versionEndExcluding":"3.5.4","matchCriteriaId":"FDBF21E2-1191-4020-A17A-0702DE4E6451"},{"vulnerable":true,"criteria":"cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*","versionStartIncluding":"2025.11.0","versionEndExcluding":"2025.11.2","matchCriteriaId":"539B5B85-44F0-408E-B994-08BB20EA9C26"},{"vulnerable":true,"criteria":"cpe:2.3:a:discourse:discourse:2025.12.0:*:*:*:stable:*:*:*","matchCriteriaId":"CCBF47A8-0D3F-4174-8084-CD3517BF272A"}]}]}],"references":[{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-955h-m28g-5379","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}}]}