Discourse Content-Security-Policy-Mitigated Cross-Site Scripting Vulnerability in Math Plugin

A cross-site scripting vulnerability has been identified in the Discourse Math plugin, specifically in its KaTeX variant. This issue is present in Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. The vulnerability is mitigated by the content security policy, but it still allows for stored cross-site scripting.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where malicious scripts can be injected and executed.

Remediation

Users can update to Discourse versions 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0. Alternatively, the Discourse Math plugin can be disabled or the Mathjax provider can be used instead of KaTeX.