CVE-2025-59337: 
NixOS vulnerability analysis and mitigation

Discourse, an open-source community discussion platform, was found to contain a vulnerability (CVE-2025-59337) affecting versions 3.5.0 and below. The vulnerability was discovered and disclosed on September 30, 2025, where malicious meta-commands could be embedded in a backup dump and executed during restore operations (GitHub Advisory).

The vulnerability is classified as a command injection vulnerability (CWE-77) with a CVSS v4.0 base score of 5.5 (Moderate). The attack vector is network-based with high attack complexity, requiring high privileges but no user interaction. The vulnerability specifically affects the backup restore functionality, where meta-commands could be injected and executed during the restore process (NVD, GitHub Advisory).

The vulnerability primarily impacts multisite setups, where an administrator of one site could potentially access data or credentials from other sites. The CVSS metrics indicate low impact on vulnerable system confidentiality but high impact on subsequent system confidentiality, integrity, and availability (GitHub Advisory).

The vulnerability has been patched in Discourse version 3.5.1 for stable releases and version 3.6.0.beta2-dev for tests-passed versions. The fix implements nonce-based restrictions during restore operations to prevent meta-command injection (GitHub Commit, GitHub Advisory).