decidim (RubyGems)
Advisories
20
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.32.0 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update decidim # Gemfile: gem "decidim", ">= 0.32.0"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-r3v7-5x4c-c69q Decidim: JWT-backed authentication can be replayed across organizations |
High EPSS 0.45% |
< 0.31.5 | 0.31.5 |
| GHSA-r3v7-5x4c-c69q Decidim: JWT-backed authentication can be replayed across organizations |
High EPSS 0.45% |
>= 0.32.0.rc1, < 0.32.0 | 0.32.0 |
| GHSA-3cx6-j9j4-54mp Decidim's private data exports can lead to data leaks |
Medium EPSS 0.31% |
>= 0.30.0, < 0.30.4 | 0.30.4 |
| GHSA-cc4g-m3g7-xmw8 Decidim has a cross-site scripting vulnerability in the version control page |
High EPSS 0.42% |
< 0.27.8 | 0.27.8 |
| GHSA-vvqw-fqwx-mqmm Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor |
Medium EPSS 0.27% |
< 0.27.7 | 0.27.7 |
| GHSA-7cx8-44pc-xv3q Decidim cross-site scripting (XSS) in the pagination |
High EPSS 0.42% |
< 0.27.6 | 0.27.6 |
| GHSA-7cx8-44pc-xv3q Decidim cross-site scripting (XSS) in the pagination |
High EPSS 0.42% |
>= 0.28.0.rc1, < 0.28.1 | 0.28.1 |
| GHSA-qcj6-vxwx-4rqv Decidim vulnerable to data disclosure through the embed feature |
Medium EPSS 0.49% |
< 0.27.6 | 0.27.6 |
| GHSA-9w99-78rj-hmxq Cross-site scripting (XSS) in the dynamic file uploads |
Medium EPSS 0.49% |
>= 0.27.0, < 0.27.5 | 0.27.5 |
| GHSA-w3q8-m492-4pwp Possibility to circumvent the invitation token expiry period |
High EPSS 0.79% |
>= 0.27.0, < 0.27.5 | 0.27.5 |
| GHSA-w3q8-m492-4pwp Possibility to circumvent the invitation token expiry period |
High EPSS 0.79% |
>= 0.0.1.alpha3, < 0.26.9 | 0.26.9 |
| GHSA-r275-j57c-7mf2 Race condition in Endorsements |
Low EPSS 0.44% |
>= 0.27.0, < 0.27.5 | 0.27.5 |
| GHSA-r275-j57c-7mf2 Race condition in Endorsements |
Low EPSS 0.44% |
>= 0.10.0, < 0.26.9 | 0.26.9 |
| GHSA-639h-86hw-qcjq Decidim has broken access control in templates |
High EPSS 0.67% |
>= 0.27.0, < 0.27.4 | 0.27.4 |
| GHSA-639h-86hw-qcjq Decidim has broken access control in templates |
High EPSS 0.67% |
>= 0.23.2, < 0.26.8 | 0.26.8 |
| GHSA-469h-mqg8-535r Decidim Cross-site Scripting vulnerability in the external link redirections |
Medium EPSS 0.82% |
>= 0.27.0, < 0.27.3 | 0.27.3 |
| GHSA-469h-mqg8-535r Decidim Cross-site Scripting vulnerability in the external link redirections |
Medium EPSS 0.82% |
>= 0.25.0, < 0.26.7 | 0.26.7 |
| GHSA-5652-92r9-3fx9 Decidim Cross-site Scripting vulnerability in the processes filter |
High EPSS 0.74% |
>= 0.14.0, < 0.26.7 | 0.26.7 |
| GHSA-5652-92r9-3fx9 Decidim Cross-site Scripting vulnerability in the processes filter |
High EPSS 0.74% |
>= 0.27.0, < 0.27.3 | 0.27.3 |
| GHSA-jm79-9pm4-vrw9 Decidim vulnerable to sensitive data disclosure |
High EPSS 1.26% |
>= 0.27.0, < 0.27.3 | 0.27.3 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor