Just rebuilt one of my Discourse forums and when I load it in the browser, the following message shows up in a popup: You’ve been hacked by a plugin! by w3shi(Hackerone)-S.Lakshmi Vignesh(RCE-POC) Holy… What is going on? One of the plugins I use was compromised?

Indeed, @RGJ is now back in control of the github organization, so we’ve removed the temporary error message.

Any chance you used the migrate password plugin? Or another plugin from the discoursehosting repository? [image] You've been hacked Discuter entre Dolibarriens Bonjour, En effet, cela était en lien avec la dernière mise à jour du forum effectuée ce midi. Cela a depuis été corrigé. Un pseudo chercheur en sécurité à récupéré un ancien dépôt git d’un plugin utilisé par le forum et l’a détourné pour... Looks like this forum was affected too Am I hacked? or not - Forum Management - Suggestions - DxO Forum

[image] Moin: Any chance you used the migrate password plugin? Or another plugin from the discoursehosting repository? Yes, it’s in the list. And the only one from discoursehosting. I remember that it needs to be active to allow “old” users to login, correct? But now the question is more if the installation was compromised or if it’s just showing this message. Site is down at the moment to be safe for now. Along with that plugin, here’s the list what I’m using: GitHub - discourse/docker_manager: Plugin for use with discourse docker image · GitHub GitHub - discourse/discourse-adplugin: Official Discourse Advertising Plugin. Install & Start Serving Ads on Your Discourse Forum · GitHub GitHub - discourse/discourse-affiliate · GitHub GitHub - discourse/discourse-ai: Discourse AI now lives in the discourse/discourse repo · GitHub GitHub - discourse/discourse-akismet: give spam a whoopin · GitHub GitHub - pfaffman/discourse-allow-pm-to-staff: Allow private messages to be sent to staff for users who could otherwise not send private messages. · GitHub GitHub - discourse/discourse-animated-avatars: A plugin to add gif avatars in Discourse · GitHub GitHub - discourse/discourse-authentication-validations · GitHub GitHub - discourse/discourse-auto-deactivate: This plugin will automatically deactivate stale users so that they need to recomfirm their email in order to login in again · GitHub GitHub - discourse/discourse-bbcode: vBulletin BBCode plugin · GitHub GitHub - discourse/discourse-bcc: Allows staff members to send individual PMs to many users at once (like email BCC) · GitHub GitHub - discourse/discourse-cakeday: Show a birthday cake emoji beside the names of members on their join anniversary, or their actual birthday -- and a browsable directory of upcoming anniversaries / birthdays. · GitHub GitHub - discourse/discourse-characters-required: Display how many characters are required before a post be made · GitHub GitHub - discourse/discourse-fingerprint: A plugin that computes user fingerprints to help administrators combat internet trolls. · GitHub GitHub - discourse/discourse-follow: A Discourse plugin that lets you follow other users. · GitHub GitHub - LeoDavidson/discourse-forcemoderation: Discourse plugin to force posts by specified usernames through moderation. · GitHub GitHub - discourse/discourse-docs · GitHub GitHub - communiteq/discourse-legal-compliance · GitHub GitHub - merefield/discourse-locations: Tools for handling locations in Discourse · GitHub https://github.com/discoursehosting/discourse-migratepassword.git GitHub - discourse/discourse-policy · GitHub GitHub - paviliondev/discourse-post-badges-plugin · GitHub GitHub - communiteq/discourse-private-topics · GitHub GitHub - discourse/discourse-push-notifications: Plugin for integrating Chrome and FireFox push notifications · GitHub GitHub - featheredtoast/discourse-pushover-notifications: Pushover notifications for Discourse · GitHub GitHub - discourse/discourse-restricted-replies: Plugin to restrict replies in a category to the OP, and members of a specified group · GitHub GitHub - discourse/discourse-saved-searches: Allow users to save searches and be notified of new results. · GitHub GitHub - discourse/discourse-shared-edits: Shared edits for Discourse · GitHub GitHub - discourse/discourse-signatures: A Discourse Plugin to show user signatures below posts · GitHub GitHub - discourse/discourse-solved: Allow accepted answers on topics · GitHub GitHub - discourse/discourse-staff-alias: Allow staff users to post under an alias · GitHub GitHub - discourse/discourse-steam-login: Allows user authentication with discourse via the Steam user API · GitHub GitHub - singerscreations/discourse-stopforumspam · GitHub GitHub - discourse/discourse-styleguide: Adds a styleguide to Discourse to aid in styling · GitHub GitHub - davidtaylorhq/discourse-telegram-notifications: A plugin for Discourse which allows users to receive their notifications by telegram message · GitHub GitHub - discourse/discourse-templates: A plugin that allows users to use templates to insert frequently used content · GitHub GitHub - discourse/discourse-tooltips: Show tooltips around Discourse on hover, including topic previews · GitHub GitHub - jannolii/discourse-topic-trade-buttons · GitHub GitHub - discourse/discourse-topic-voting: Adds the ability for voting on a topic within a specified category in Discourse. · GitHub GitHub - discourse/discourse-translator · GitHub GitHub - discourse/discourse-user-field-prompt · GitHub GitHub - communiteq/discourse-user-response-times · GitHub GitHub - discourse/discourse-whos-online: A plugin for Discourse which uses the messagebus to display a live list of active users · GitHub GitHub - discourse/discourse-yearly-review: Publishes an automated Year in Review topic · GitHub

just remove anything referring to discoursehosting

Google Translate of the French forum post: A pseudo-security researcher retrieved an old Git repository for a plugin used by the forum and hijacked it to simply display this message. The repository in question (GitHub - discoursehosting/discourse-migratepassword: A touch of security) has been inspected and no malicious code is present (it’s simply a proof of concept). This repository had actually changed its URL (it is now available at GitHub - communiteq/discourse-migratepassword: Support migrated password hashes) and the user simply recreated the discoursehosting/discourse-migratepassword repository, which previously redirected to communiteq/discourse-migratepassword, to place unrelated code there. We were using the old URL, which is why we were affected. If that’s true, okay… I changed the url of the plugin to communiteq and am rebuilding at the moment. But I have to look into this more (as I am not a programmer, I can’t be 100% sure).

TL;DR This is a Github vulnerability in an exploit class called “Repojacking”. We recommend everyone to check their Github plugin URLs and rename each and every instance of discoursehosting to communiteq Background: We had to rename our company from Discoursehosting to Communiteq in 2019. If that happens, Github automatically redirects URLs to github repositories to their new location, until someone creates a repository with the same name. At that moment the new repository will take preference. Github used to mark such repositories as “retired” and prohibited creating a repository with the same name. A previous exploit is described here. Apparently that fix is no longer effective. We have filed a Github abuse report and will try to take this repository down with all available means.

[image] Roi: But now the question is more if the installation was compromised or if it’s just showing this message At this moment the compromised plugin only shows a message and leaves a harmless file in /tmp. So nothing bad has happened - yet. It is important to change your plugin URL before you rebuild.

[image] RGJ: Repojacking wow it can catch the end user out easily, one of the main disadvantages of not using discourse.org official hosting. If either angusmcleod (Angus McLeod) · GitHub or merefield (Robert) · GitHub accounts ceased to exist then a first sub-path would be exposed, so there would be a clone command sitting in my app.yml for a rebuild to execute

To mitigate the potential impact for users of the standard install, we’ve added code to detect github.com/discoursehosting/ and abort any rebuilds/upgrades. Fail rebuild for config files containing compromised github organisat… · discourse/discourse_docker@7889fe3 · GitHub Fail rebuild for config files containing compromised github organisat… · discourse/docker_manager@f568625 · GitHub The error will look something like --- ERROR: The configuration file containers/app.yml contains references to a compromised github organization: github.com/discoursehosting Please remove any references to this organization from your configuration file. For more information, see https://meta.discourse.org/t/374703/6 ---

Hello Discourse community, I want to sincerely apologize for the disruption caused by my actions regarding the plugin repository. In attempting to highlight a security issue, I made serious mistakes that violated the code of conduct. Going forward, I will ensure my actions adhere to responsible disclosure practices and I appreciate the opportunity to learn from this. Again, I am truly sorry for the disruption caused. @w3shi

Third-party plugin repository hijacked

Product Support

schleifer (Andrew Schleifer) July 22, 2025, 2:40pm 14

Welcome to the community and thank you for fixing everything up.

Topic		Replies	Views
Installation Error when rebuilding with Discourse Official Plugins (Discourse v2.0.3) Self-hosting solved	7	2817	August 16, 2018
Forum not working after update – what’s missing? Self-hosting	35	1055	September 4, 2025
Check plugin or theme validity Product Support	14	1641	December 30, 2019
Deprecated plugins after update? Self-hosting	3	393	November 23, 2023
Github integration for Discourse hosted Product Support	1	486	September 8, 2021

Third-party plugin repository hijacked

Related topics