Untriaged
by @jopejoe1 Activity log
- Created automatic suggestion
-
@jopejoe1
removed
4 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
Discourse vulnerable to stored Cross-site Scripting via Katex in discourse-math plugin
Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have a content-security-policy-mitigated cross-site scriptinv vulnerability on the Discourse Math plugin when using its KaTeX variant. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, the Discourse Math plugin can be disabled, or the Mathjax provider can be used instead of KaTeX.
Affected products
discourse
- ==< 3.5.4
- ==>= 2026.1.0-latest, < 2026.1.0
- ==>= 2025.12.0-latest, < 2025.12.1
- ==>= 2025.11.0-latest, < 2025.11.2
Matching in nixpkgs
pkgs.discourse
Discourse is an open source discussion platform
Ignored packages (4)
pkgs.discourse-mail-receiver
Helper program which receives incoming mail for Discourse
pkgs.python312Packages.pydiscourse
Python library for working with Discourse
pkgs.python313Packages.pydiscourse
Python library for working with Discourse
pkgs.grafanaPlugins.grafana-discourse-datasource
Allows users to search and view topics, posts, users, tags, categories, and reports on a given Discourse forum through Grafana
Package maintainers
-
@talyz Kim Lindberger <kim.lindberger@gmail.com>
-
@Dettorer Paul Hervot <paul.hervot@dettorer.net>
-
@nagisa Simonas Kazlauskas <nixpkgs@kazlauskas.me>