RubyGems Package Vulnerabilities
Vulnerabilities associated with decidim.
Packages
Clear package- actionpack63 vulnerabilities
- nokogiri59 vulnerabilities
- rack50 vulnerabilities
- rubygems-update25 vulnerabilities
- activerecord23 vulnerabilities
- puppet23 vulnerabilities
- activesupport17 vulnerabilities
- camaleon_cms15 vulnerabilities
- publify_core15 vulnerabilities
- rails-html-sanitizer15 vulnerabilities
- passenger14 vulnerabilities
- puma14 vulnerabilities
- actionview13 vulnerabilities
- decidim13 vulnerabilities
- fat_free_crm12 vulnerabilities
- activestorage11 vulnerabilities
- loofah11 vulnerabilities
- oj11 vulnerabilities
- rails11 vulnerabilities
- net-imap10 vulnerabilities
- ruby-saml10 vulnerabilities
- decidim-core9 vulnerabilities
- jquery-rails9 vulnerabilities
- openc39 vulnerabilities
- avo8 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-45414HIGH | Decidim: JWT-backed authentication can be replayed across organizationsDecidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read participantDetails data and reach the proposal.answer mutation path. This issue is fixed in versions 0.31.5 and 0.32.0.rc2. | CVSS8.5v3.1 | EPSS0.324% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-65017HIGH | Decidim's private data exports can lead to data leaksDecidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0, the private data exports can lead to data leaks in case the UUID generation, causing collisions for the generated UUIDs. This issue has been patched in versions 0.30.4 and 0.31.0. | CVSS8.2v4.0 | EPSS0.262% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Decidim has a cross-site scripting vulnerability in the version control pageDecidim is a participatory democracy framework. The version control feature used in resources is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.27.8. CWE-79Oct 1, 2024 | CVSS-v4.0 | EPSS0.4% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editordecidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded to the server. The attacker is able to change e.g. to <svg onload=alert('XSS')> if they know how to craft these requests themselves. This issue has been addressed in release version 0.27.7. All users are advised to upgrade. Users unable to up… CWE-79Sep 16, 2024 | CVSS-v4.0 | EPSS0.26% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Decidim has cross-site scripting (XSS) in the paginationDecidim is a participatory democracy framework. The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter `per_page`. This vulnerability is fixed in 0.27.6 and 0.28.1. CWE-79Jul 10, 2024 | CVSS-v4.0 | EPSS0.417% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Decidim vulnerable to data disclosure through the embed featureDecidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embbeded (such as a Participatory Process, an Assembly, a Proposal, a Result, etc), then some data of this resource could be accessed. This vulnerability is fixed in 0.27.6. CWE-200Jul 10, 2024 | CVSS-v4.0 | EPSS0.492% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2023-51447MEDIUM | Decidim vulnerable to cross-site scripting (XSS) in the dynamic file uploadsDecidim is a participatory democracy framework. Starting in version 0.27.0 and prior to versions 0.27.5 and 0.28.0, the dynamic file upload feature is subject to potential cross-site scripting attacks in case the attacker manages to modify the file names of the records being uploaded to the server. This appears in sections where the user controls the file upload dialogs themselves and has the technical knowledge to change the file names through the dynamic upload endpoint. Therefore I believe it… CWE-79Feb 20, 2024 | CVSS6.3v3.1 | EPSS0.493% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-48220MEDIUM | Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry periodDecidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality. This issue creates vulnerable dependencies starting in version 0.0.1.alpha3 and prior to versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-system` gems. When using the password reset functionality, th… CWE-672Feb 20, 2024 | CVSS5.7v3.1 | EPSS0.791% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Decidim has race condition in EndorsementsDecidim is a participatory democracy framework. Starting in version 0.10.0 and prior to versions 0.26.9, 0.27.5, and 0.28.0, a race condition in the endorsement of resources (for instance, a proposal) allows a user to make more than once endorsement. To exploit this vulnerability, the request to set an endorsement must be sent several times in parallel. Versions 0.26.9, 0.27.5, and 0.28.0 contain a patch for this issue. As a workaround, disable the Endorsement feature in the components. CWE-362Feb 20, 2024 | CVSS3.1v3.1 | EPSS0.444% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2023-36465CRITICAL | Decidim has broken access control in templatesDecidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The `templates` module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys. This issue has been patched in version 0.26.8 and 0.27.4. | CVSS9.1v3.1 | EPSS0.541% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-34089HIGH | Decidim Cross-site Scripting vulnerability in the processes filterDecidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was … CWE-79Jul 11, 2023 | CVSS8.1v3.1 | EPSS0.736% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-34090HIGH | Decidim vulnerable to sensitive data disclosureDecidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. Decidim uses a third-party library named Ransack for filtering certain database collections (e.g., public meetings). By default, this library allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database of a Decidim instance (… CWE-200Jul 11, 2023 | CVSS7.5v3.1 | EPSS1.25% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-32693HIGH | Decidim Cross-site Scripting vulnerability in the external link redirectionsDecidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The external link feature is susceptible to cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was pat… CWE-79Jul 11, 2023 | CVSS8.1v3.1 | EPSS0.816% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |