« Volver al listado

CVE-2025-53532

Estado: AplazadaMedia (5.3)—

giscus is a commenting system powered by GitHub Discussions. A bug in giscus' discussions creation API allowed an unauthorized user to create discussions on any repository where giscus is installed. This affects the server-side part of giscus, which is provided via http://giscus.app or your own self-hosted service. This vulnerability is fixed by the c43af7806e65adfcf4d0feeebef76dc36c95cb9a and 4b9745fe1a326ce08d69f8a388331bc993d19389 commits.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Giscus — GiscusAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-53532",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-53532",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-07T17:52:34.931217Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "giscus",
          "product": "giscus",
          "versions": [
            {
              "status": "affected",
              "version": "< c43af7806e65adfcf4d0feeebef76dc36c95cb9a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-07-07T17:15:30.533",
  "references": [
    {
      "url": "https://github.com/giscus/giscus/commit/4b9745fe1a326ce08d69f8a388331bc993d19389",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/giscus/giscus/commit/c43af7806e65adfcf4d0feeebef76dc36c95cb9a",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/giscus/giscus/security/advisories/GHSA-w6vg-v24f-4vm3",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "giscus is a commenting system powered by GitHub Discussions. A bug in giscus' discussions creation API allowed an unauthorized user to create discussions on any repository where giscus is installed. This affects the server-side part of giscus, which is provided via http://giscus.app or your own self-hosted service. This vulnerability is fixed by the c43af7806e65adfcf4d0feeebef76dc36c95cb9a and 4b9745fe1a326ce08d69f8a388331bc993d19389 commits."
    },
    {
      "lang": "es",
      "value": "giscus es un sistema de comentarios impulsado por Discusiones de GitHub. Un error en la API de creación de discusiones de giscus permitió que un usuario no autorizado creara discusiones en cualquier repositorio donde estuviera instalado. Esto afecta a la parte del servidor de giscus, que se proporciona a través de http://giscus.app o de un servicio alojado por el usuario. Esta vulnerabilidad se corrige con las confirmaciones c43af7806e65adfcf4d0feeebef76dc36c95cb9a y 4b9745fe1a326ce08d69f8a388331bc993d19389."
    }
  ],
  "lastModified": "2026-06-17T09:38:23.897",
  "sourceIdentifier": "security-advisories@github.com"
}