CVE-2024-53266

Summary

CVE-2024-53266 is a newly disclosed vulnerability affecting Discourse, an open-source community discussion platform. In certain configurations with specific plugins, and when Content Security Policy (CSP) is disabled, the activity streams on user profile pages become susceptible to Cross-Site Scripting (XSS) attacks. This issue has been rectified in the latest version of Discourse core. It is strongly recommended that users upgrade to the latest version to mitigate this risk. For those who cannot upgrade at present, enabling CSP is essential to prevent potential XSS attacks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.