CVE-2025-48877 is a critical flaw (CVSS 9.8 in the record, rated Low by the project) in Discourse. Codepen sits in the default allowed iframes setting and can auto run script in the iframe. It is fixed in stable 3.4.4 and beta 3.5.0.beta5. You can also remove the Codepen prefix from the setting.
What's affected
The Discourse GitHub advisory lists these affected ranges: stable before 3.4.4, beta before 3.5.0.beta5, and tests-passed before 3.5.0.beta5. The patched versions are stable 3.4.4 or later, and beta or tests-passed 3.5.0.beta5 or later.
The advisory describes the impact as follows. Codepen is present in the default allowed_iframes site setting, and it can potentially auto run arbitrary JavaScript in the iframe scope, which is unintended. The advisory's own severity is Low. The CVE record carries a 9.8 Critical score. That gap is large, so read the details before deciding how urgent this is for your forum.
Neither source says the issue has been exploited, and the advisory gives no further technical detail.
How to check if you're exposed
Find your Discourse version in the admin dashboard, or from your deployment tooling. Then check the setting. In the admin area, open Settings and search for allowed iframes, then look for a Codepen entry in the list.
If you run a standard container install, you can also confirm the version of the running application after an upgrade through the same dashboard. If the version is older than the patched releases above and the Codepen prefix is in the list, you are in scope.
If your site uses a hosted service from the vendor, check with them about the version. Self hosted sites carry the update responsibility themselves.
What to do now
- Upgrade Discourse to stable 3.4.4 or later, or to beta 3.5.0.beta5 or later. With the standard container install, the usual path is the admin upgrade page or a rebuild of the app container.
- If you cannot upgrade today, remove the Codepen prefix from the allowed_iframes site setting. The advisory gives this as the workaround.
- Decide whether your community needs embedded Codepen content at all. Fewer allowed embeds mean less third party code in your pages.
- Review other entries in allowed_iframes and keep only the services you rely on.
Why it matters
The record lists CWE-1038, but that weakness name, which relates to automated optimisations, does not describe the advisory text well, and the advisory itself lists no weakness class. In plain terms, a service on a trusted list for embedding was able to run script automatically when its content was shown, and the default list made that a default behaviour.
Allow lists are a sound control, but each entry extends trust to everything the third party serves, now and in future. A default list is a decision made for everyone, and operators rarely revisit it. This case shows why a periodic review of such settings is worth the few minutes.
Discourse is not on the CISA Known Exploited Vulnerabilities list for this CVE. A vulnerability scan that records the application version will help you catch instances that miss the update window.
Quick check
What is the quick workaround for CVE-2025-48877?
Remove the Codepen prefix from the allowed_iframes site setting, as the advisory describes, then plan the upgrade.
Why do the project and the CVE record disagree on severity?
The project rates the advisory Low, and the record shows a 9.8 Critical score. The advisory does not explain the gap, so use the fix versions and the workaround rather than the number to decide what to do.
Sources
Last reviewed: 18 October 2026.
