Description
Decidim is a participatory democracy framework. The version control feature used in resources is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.27.8.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://github.com/decidim/decidim/security/advisories/GHSA-cc4g-m3g7-xmw8
Scores
CVSS v3
7.1
EPSS
0.0042
EPSS Percentile
61.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (2)
decidim/decidim
< 0.27.8
rubygems/decidim
0 - 0.27.8RubyGems
Published
Oct 01, 2024
Tracked Since
Feb 18, 2026