CVE-2024-53266: 
NixOS vulnerability analysis and mitigation

Discourse, an open source platform for community discussion, was found to be vulnerable to Cross-Site Scripting (XSS) attacks in activity streams on user profile pages. The vulnerability (CVE-2024-53266) was disclosed on February 4, 2025, affecting versions prior to 3.3.3 (stable) and 3.4.0.beta4 (tests-passed) when Content Security Policy (CSP) is disabled and certain plugin combinations are present (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability requires network access, has low attack complexity, requires low privileges, needs no user interaction, has unchanged scope, and can impact confidentiality but not integrity or availability (GitHub Advisory).

The vulnerability allows attackers to execute arbitrary JavaScript code in the context of other users' browsers when viewing activity streams in profile pages, potentially leading to the compromise of user data and session information (GitHub Advisory).

The vulnerability has been patched in Discourse core version 3.3.3 (stable) and 3.4.0.beta4 (tests-passed). For users unable to upgrade immediately, enabling Content Security Policy (CSP) serves as an effective workaround to prevent exploitation (GitHub Advisory).