CISA has identified a critical vulnerability within the open-source community discussion forum, and mailing list management platform Discourse, that could allow attackers to commit remote code execution (RCE) against targeted vulnerable systems. The vulnerability, tracked as CVE-2021-41163, is abused by sending maliciously crafted requests to Discourse versions below 2.7.9, exploiting a lack of validation in the “subscribe-url” values. Discourse is widely used and extremely popular, and this exploit can potentially affect thousands of vulnerable systems. This flaw has already been patched as of Friday in the latest stable, beta and tests-passed versions of Discourse, and users are urged to upgrade to version 2.7.9 immediately. For administrators who cannot update to 2.7.9, a workaround can be implemented to block requests with a path starting with “/webhooks/aws”. Currently, the flaw is still undergoing technical analysis, however the researcher who identified the flaw has released a technical analysis about it linked below. CTAPT will monitor this situation and provide updates to our readers as more details surrounding the exploit become public.