GitHub Advisoryadvisory · RubyGems
GHSA-cc4g-m3g7-xmw8 Decidim has a cross-site scripting vulnerability in the version control page
HIGH
Official page ↗
- Aliases
- CVE-2024-41673
- Ecosystem
- RubyGems
- Packages
- decidim
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2024-10-01
Affected packages
• RubyGems decidim: < 0.27.8 → fixed in 0.27.8
Description
Impact
The version control feature used in resources is subject to potential cross-site scripting (XSS) attack through a malformed URL.
Workarounds
Not available
References
OWASP ASVS v4.0.3-5.1.3
Credits
This issue was discovered in a security audit organized by Open Source Politics against Decidim done during July 2025.
Related
Alias · CVE (1)
- CVE-2024-41673 Decidim is a participatory democracy framework. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/decidim/decidim/security/advisories/GHSA-cc4g-m3g7-xmw8 web
- https://nvd.nist.gov/vuln/detail/CVE-2024-41673 advisory
- https://github.com/decidim/decidim/commit/8a18c8b1ee85a1b35ee0d8d5893f218695d15637 web
- https://github.com/decidim/decidim package
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-41673.yml web