Disclosure: The Anatomy of a Remote Code Execution bug on Disqus (0day)

The post is not very clear, but disqus already released a patch for it last night (included on version 2.76).