decidim-core (RubyGems)
Advisories
19
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.32.0 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update decidim-core # Gemfile: gem "decidim-core", ">= 0.32.0"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-2g9c-vf8h-prxx Decidim: Push subscriptions can be abused for server-side requests |
Medium EPSS 0.26% |
< 0.30.9 | 0.30.9 |
| GHSA-2g9c-vf8h-prxx Decidim: Push subscriptions can be abused for server-side requests |
Medium EPSS 0.26% |
>= 0.32.0.rc1, < 0.32.0 | 0.32.0 |
| GHSA-2g9c-vf8h-prxx Decidim: Push subscriptions can be abused for server-side requests |
Medium EPSS 0.26% |
>= 0.31.0.rc1, < 0.31.5 | 0.31.5 |
| GHSA-533c-2vh9-4r86 Decidim: HTML content blocks allow stored script execution |
Medium EPSS 0.25% |
>= 0.32.0.rc1, < 0.32.0 | 0.32.0 |
| GHSA-533c-2vh9-4r86 Decidim: HTML content blocks allow stored script execution |
Medium EPSS 0.25% |
< 0.30.9 | 0.30.9 |
| GHSA-533c-2vh9-4r86 Decidim: HTML content blocks allow stored script execution |
Medium EPSS 0.25% |
>= 0.31.0.rc1, < 0.31.5 | 0.31.5 |
| GHSA-767h-63j4-5226 Decidim: Private exports can be downloaded through reusable links |
Medium EPSS 0.45% |
< 0.30.9 | 0.30.9 |
| GHSA-767h-63j4-5226 Decidim: Private exports can be downloaded through reusable links |
Medium EPSS 0.45% |
>= 0.32.0.rc1, < 0.32.0 | 0.32.0 |
| GHSA-767h-63j4-5226 Decidim: Private exports can be downloaded through reusable links |
Medium EPSS 0.45% |
>= 0.31.0.rc1, < 0.31.5 | 0.31.5 |
| GHSA-w5xj-99cg-rccm Decidim amendments can be accepted or rejected by anyone |
Medium EPSS 0.22% |
>= 0.19.0, < 0.30.5 | 0.30.5 |
| GHSA-w5xj-99cg-rccm Decidim amendments can be accepted or rejected by anyone |
Medium EPSS 0.22% |
>= 0.31.0.rc1, < 0.31.1 | 0.31.1 |
| GHSA-fc46-r95f-hq7g Decidim has a cross-site scripting (XSS) in user name |
High EPSS 0.36% |
>= 0.31.0.rc1, < 0.31.1 | 0.31.1 |
| GHSA-fc46-r95f-hq7g Decidim has a cross-site scripting (XSS) in user name |
High EPSS 0.36% |
< 0.30.5 | 0.30.5 |
| GHSA-3cx6-j9j4-54mp Decidim's private data exports can lead to data leaks |
Medium EPSS 0.31% |
>= 0.30.0, < 0.30.4 | 0.30.4 |
| GHSA-9w99-78rj-hmxq Cross-site scripting (XSS) in the dynamic file uploads |
Medium EPSS 0.49% |
>= 0.27.0, < 0.27.5 | 0.27.5 |
| GHSA-469h-mqg8-535r Decidim Cross-site Scripting vulnerability in the external link redirections |
Medium EPSS 0.82% |
>= 0.25.0, < 0.26.7 | 0.26.7 |
| GHSA-469h-mqg8-535r Decidim Cross-site Scripting vulnerability in the external link redirections |
Medium EPSS 0.82% |
>= 0.27.0, < 0.27.3 | 0.27.3 |
| GHSA-5652-92r9-3fx9 Decidim Cross-site Scripting vulnerability in the processes filter |
High EPSS 0.74% |
>= 0.14.0, < 0.26.7 | 0.26.7 |
| GHSA-5652-92r9-3fx9 Decidim Cross-site Scripting vulnerability in the processes filter |
High EPSS 0.74% |
>= 0.27.0, < 0.27.3 | 0.27.3 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor