Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/167773?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/167773?format=api", "purl": "pkg:gem/decidim-core@0.23.4", "type": "gem", "namespace": "", "name": "decidim-core", "version": "0.23.4", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": null, "latest_non_vulnerable_version": null, "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/49962?format=api", "vulnerability_id": "VCID-25zg-267g-w3cn", "summary": "Decidim's private data exports can lead to data leaks\nPrivate data exports can lead to data leaks in cases where the UUID generation causes collisions for the generated UUIDs.\n\nThe bug was introduced by #13571 and affects Decidim versions 0.30.0 or newer (currently 2025-09-23).\n\nThis issue was discovered by running the following spec several times in a row, as it can randomly fail due to this bug:\n\n```bash\n$ cd decidim-core\n$ for i in {1..10}; do bundle exec rspec spec/jobs/decidim/download_your_data_export_job_spec.rb -e \"deletes the\" || break ; done\n```\n\nRun the spec as many times as needed to hit a UUID that converts to `0` through `.to_i`.\n\nThe UUID to zero conversion does not cause a security issue but the security issue is demonstrated with the following example.\n\nThe following code regenerates the issue by assigning a predefined UUID that will generate a collision (example assumes there are already two existing users in the system):\n\n```ruby", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-65017", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00054", "scoring_system": "epss", "scoring_elements": "0.17321", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-65017" }, { "reference_url": "https://github.com/decidim/decidim", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/decidim/decidim" }, { "reference_url": "https://github.com/decidim/decidim/pull/13571", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-02-03T17:09:13Z/" } ], "url": "https://github.com/decidim/decidim/pull/13571" }, { "reference_url": "https://github.com/decidim/decidim/releases/tag/v0.30.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-02-03T17:09:13Z/" } ], "url": "https://github.com/decidim/decidim/releases/tag/v0.30.4" }, { "reference_url": "https://github.com/decidim/decidim/releases/tag/v0.31.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-02-03T17:09:13Z/" } ], "url": "https://github.com/decidim/decidim/releases/tag/v0.31.0" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65017", "reference_id": "CVE-2025-65017", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65017" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2025-65017.yml", "reference_id": "CVE-2025-65017.YML", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2025-65017.yml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2025-65017.yml", "reference_id": "CVE-2025-65017.YML", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2025-65017.yml" }, { "reference_url": "https://github.com/advisories/GHSA-3cx6-j9j4-54mp", "reference_id": "GHSA-3cx6-j9j4-54mp", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-3cx6-j9j4-54mp" }, { "reference_url": "https://github.com/decidim/decidim/security/advisories/GHSA-3cx6-j9j4-54mp", "reference_id": "GHSA-3cx6-j9j4-54mp", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "8.2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-02-03T17:09:13Z/" } ], "url": "https://github.com/decidim/decidim/security/advisories/GHSA-3cx6-j9j4-54mp" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/73827?format=api", "purl": "pkg:gem/decidim-core@0.30.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25zg-267g-w3cn" }, { "vulnerability": "VCID-k1gk-pcda-a7cb" }, { "vulnerability": "VCID-m38p-yqcn-nka4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/decidim-core@0.30.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/173879?format=api", "purl": "pkg:gem/decidim-core@0.31.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25zg-267g-w3cn" }, { "vulnerability": "VCID-k1gk-pcda-a7cb" }, { "vulnerability": "VCID-m38p-yqcn-nka4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/decidim-core@0.31.0" } ], "aliases": [ "CVE-2025-65017", "GHSA-3cx6-j9j4-54mp" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-25zg-267g-w3cn" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/47067?format=api", "vulnerability_id": "VCID-2w9q-zpvy-vub1", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nDecidim is a participatory democracy framework. Starting in version 0.27.0 and prior to versions 0.27.5 and 0.28.0, the dynamic file upload feature is subject to potential cross-site scripting attacks in case the attacker manages to modify the file names of the records being uploaded to the server. This appears in sections where the user controls the file upload dialogs themselves and has the technical knowledge to change the file names through the dynamic upload endpoint. Therefore I believe it would require the attacker to control the whole session of the particular user but in any case, this needs to be fixed. Successful exploit of this vulnerability would require the user to have successfully uploaded a file blob to the server with a malicious file name and then have the possibility to direct the other user to the edit page of the record where the attachment is attached. The users are able to craft the direct upload requests themselves controlling the file name that gets stored to the database. The attacker is able to change the filename e.g. to `<svg onload=alert('XSS')>` if they know how to craft these requests themselves. And then enter the returned blob ID to the form inputs manually by modifying the edit page source. Versions 0.27.5 and 0.28.0 contain a patch for this issue. As a workaround, disable dynamic uploads for the instance, e.g. from proposals.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-51447", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00487", "scoring_system": "epss", "scoring_elements": "0.65804", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-51447" }, { "reference_url": "https://github.com/decidim/decidim", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/decidim/decidim" }, { "reference_url": "https://github.com/decidim/decidim/commit/aaf72787cf18beeeb6a771c1f7cbb7654b073423", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-02-21T19:26:23Z/" } ], "url": "https://github.com/decidim/decidim/commit/aaf72787cf18beeeb6a771c1f7cbb7654b073423" }, { "reference_url": "https://github.com/decidim/decidim/pull/11612", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-02-21T19:26:23Z/" } ], "url": "https://github.com/decidim/decidim/pull/11612" }, { "reference_url": "https://github.com/decidim/decidim/releases/tag/v0.27.5", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-02-21T19:26:23Z/" } ], "url": "https://github.com/decidim/decidim/releases/tag/v0.27.5" }, { "reference_url": "https://github.com/decidim/decidim/releases/tag/v0.28.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-02-21T19:26:23Z/" } ], "url": "https://github.com/decidim/decidim/releases/tag/v0.28.0" }, { "reference_url": "https://github.com/rails/rails/blob/a967d355c6fee9ad9b8bd115d43bc8b0fc207e7e/activestorage/app/controllers/active_storage/direct_uploads_controller.rb#L14", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-02-21T19:26:23Z/" } ], "url": "https://github.com/rails/rails/blob/a967d355c6fee9ad9b8bd115d43bc8b0fc207e7e/activestorage/app/controllers/active_storage/direct_uploads_controller.rb#L14" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51447", "reference_id": "CVE-2023-51447", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51447" }, { "reference_url": "https://github.com/advisories/GHSA-9w99-78rj-hmxq", "reference_id": "GHSA-9w99-78rj-hmxq", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-9w99-78rj-hmxq" }, { "reference_url": "https://github.com/decidim/decidim/security/advisories/GHSA-9w99-78rj-hmxq", "reference_id": "GHSA-9w99-78rj-hmxq", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-02-21T19:26:23Z/" } ], "url": "https://github.com/decidim/decidim/security/advisories/GHSA-9w99-78rj-hmxq" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/69078?format=api", "purl": "pkg:gem/decidim-core@0.27.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25zg-267g-w3cn" }, { "vulnerability": "VCID-2w9q-zpvy-vub1" }, { "vulnerability": "VCID-k1gk-pcda-a7cb" }, { "vulnerability": "VCID-m38p-yqcn-nka4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/decidim-core@0.27.5" } ], "aliases": [ "CVE-2023-51447", "GHSA-9w99-78rj-hmxq" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-2w9q-zpvy-vub1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/45611?format=api", "vulnerability_id": "VCID-6qvm-vkcy-2qhs", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nDecidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The external link feature is susceptible to cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was patched in versions 0.27.3 and 0.26.7.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-32693", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00227", "scoring_system": "epss", "scoring_elements": "0.45633", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-32693" }, { "reference_url": "https://github.com/decidim/decidim", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/decidim/decidim" }, { "reference_url": "https://github.com/decidim/decidim/releases/tag/v0.26.7", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-11-04T19:43:24Z/" } ], "url": "https://github.com/decidim/decidim/releases/tag/v0.26.7" }, { "reference_url": "https://github.com/decidim/decidim/releases/tag/v0.27.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-11-04T19:43:24Z/" } ], "url": "https://github.com/decidim/decidim/releases/tag/v0.27.3" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32693", "reference_id": "CVE-2023-32693", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32693" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2023-32693.yml", "reference_id": "CVE-2023-32693.YML", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2023-32693.yml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2023-32693.yml", "reference_id": "CVE-2023-32693.YML", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2023-32693.yml" }, { "reference_url": "https://github.com/advisories/GHSA-469h-mqg8-535r", "reference_id": "GHSA-469h-mqg8-535r", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-469h-mqg8-535r" }, { "reference_url": "https://github.com/decidim/decidim/security/advisories/GHSA-469h-mqg8-535r", "reference_id": "GHSA-469h-mqg8-535r", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-11-04T19:43:24Z/" } ], "url": "https://github.com/decidim/decidim/security/advisories/GHSA-469h-mqg8-535r" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/66023?format=api", "purl": "pkg:gem/decidim-core@0.26.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25zg-267g-w3cn" }, { "vulnerability": "VCID-2w9q-zpvy-vub1" }, { "vulnerability": "VCID-6qvm-vkcy-2qhs" }, { "vulnerability": "VCID-8vnm-acnm-h3e5" }, { "vulnerability": "VCID-k1gk-pcda-a7cb" }, { "vulnerability": "VCID-m38p-yqcn-nka4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/decidim-core@0.26.7" }, { "url": "http://public2.vulnerablecode.io/api/packages/66024?format=api", "purl": "pkg:gem/decidim-core@0.27.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25zg-267g-w3cn" }, { "vulnerability": "VCID-2w9q-zpvy-vub1" }, { "vulnerability": "VCID-6qvm-vkcy-2qhs" }, { "vulnerability": "VCID-8vnm-acnm-h3e5" }, { "vulnerability": "VCID-k1gk-pcda-a7cb" }, { "vulnerability": "VCID-m38p-yqcn-nka4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/decidim-core@0.27.3" } ], "aliases": [ "CVE-2023-32693", "GHSA-469h-mqg8-535r" ], "risk_score": 3.6, "exploitability": "0.5", "weighted_severity": "7.3", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-6qvm-vkcy-2qhs" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/45610?format=api", "vulnerability_id": "VCID-8vnm-acnm-h3e5", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nDecidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was patched in version 0.27.3 and 0.26.7.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-34089", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00146", "scoring_system": "epss", "scoring_elements": "0.34822", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-34089" }, { "reference_url": "https://github.com/decidim/decidim", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/decidim/decidim" }, { "reference_url": "https://github.com/decidim/decidim/releases/tag/v0.26.6", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-11-04T19:43:06Z/" } ], "url": "https://github.com/decidim/decidim/releases/tag/v0.26.6" }, { "reference_url": "https://github.com/decidim/decidim/releases/tag/v0.26.7", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/decidim/decidim/releases/tag/v0.26.7" }, { "reference_url": "https://github.com/decidim/decidim/releases/tag/v0.27.3", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-11-04T19:43:06Z/" } ], "url": "https://github.com/decidim/decidim/releases/tag/v0.27.3" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34089", "reference_id": "CVE-2023-34089", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34089" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2023-34089.yml", "reference_id": "CVE-2023-34089.YML", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2023-34089.yml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2023-34089.yml", "reference_id": "CVE-2023-34089.YML", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2023-34089.yml" }, { "reference_url": "https://github.com/advisories/GHSA-5652-92r9-3fx9", "reference_id": "GHSA-5652-92r9-3fx9", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-5652-92r9-3fx9" }, { "reference_url": "https://github.com/decidim/decidim/security/advisories/GHSA-5652-92r9-3fx9", "reference_id": "GHSA-5652-92r9-3fx9", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-11-04T19:43:06Z/" } ], "url": "https://github.com/decidim/decidim/security/advisories/GHSA-5652-92r9-3fx9" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/66023?format=api", "purl": "pkg:gem/decidim-core@0.26.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25zg-267g-w3cn" }, { "vulnerability": "VCID-2w9q-zpvy-vub1" }, { "vulnerability": "VCID-6qvm-vkcy-2qhs" }, { "vulnerability": "VCID-8vnm-acnm-h3e5" }, { "vulnerability": "VCID-k1gk-pcda-a7cb" }, { "vulnerability": "VCID-m38p-yqcn-nka4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/decidim-core@0.26.7" }, { "url": "http://public2.vulnerablecode.io/api/packages/66024?format=api", "purl": "pkg:gem/decidim-core@0.27.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25zg-267g-w3cn" }, { "vulnerability": "VCID-2w9q-zpvy-vub1" }, { "vulnerability": "VCID-6qvm-vkcy-2qhs" }, { "vulnerability": "VCID-8vnm-acnm-h3e5" }, { "vulnerability": "VCID-k1gk-pcda-a7cb" }, { "vulnerability": "VCID-m38p-yqcn-nka4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/decidim-core@0.27.3" } ], "aliases": [ "CVE-2023-34089", "GHSA-5652-92r9-3fx9" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8vnm-acnm-h3e5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/51597?format=api", "vulnerability_id": "VCID-k1gk-pcda-a7cb", "summary": "Decidim has a cross-site scripting (XSS) in user name\n### Impact\n\nA stored code execution vulnerability in the user name field allows\na low-privileged attacker to execute arbitrary code in the context\nof any user who passively visits a comment page, resulting in high\nconfidentiality and integrity impact across security boundaries.\n\n### Patches\n\nN/A\n\n### Workarounds\n\nNot available\n\n### References\n\nOWASP ASVS v4.0.3-5.1.3\n\n### Credits\n\nThis issue was discovered in a security audit organized by\n[octree](https://octree.ch/) and made by\n[Secu Labs](https://seculabs.ch/) against Decidim financed\nby the city of Lausanne (Switzerland).", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-23891", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00053", "scoring_system": "epss", "scoring_elements": "0.16846", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-23891" }, { "reference_url": "https://github.com/decidim/decidim", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/decidim/decidim" }, { "reference_url": "https://github.com/decidim/decidim/releases/tag/v0.30.5", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:23:47Z/" } ], "url": "https://github.com/decidim/decidim/releases/tag/v0.30.5" }, { "reference_url": "https://github.com/decidim/decidim/releases/tag/v0.31.1", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:23:47Z/" } ], "url": "https://github.com/decidim/decidim/releases/tag/v0.31.1" }, { "reference_url": "https://github.com/decidim/decidim/security/advisories/GHSA-fc46-r95f-hq7g", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.7", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "8.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-14T15:23:47Z/" } ], "url": "https://github.com/decidim/decidim/security/advisories/GHSA-fc46-r95f-hq7g" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2026-23891.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2026-23891.yml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23891", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23891" }, { "reference_url": "https://github.com/advisories/GHSA-fc46-r95f-hq7g", "reference_id": "GHSA-fc46-r95f-hq7g", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-fc46-r95f-hq7g" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/110365?format=api", "purl": "pkg:gem/decidim-core@0.30.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25zg-267g-w3cn" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/decidim-core@0.30.5" }, { "url": "http://public2.vulnerablecode.io/api/packages/110363?format=api", "purl": "pkg:gem/decidim-core@0.31.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25zg-267g-w3cn" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/decidim-core@0.31.1" } ], "aliases": [ "CVE-2026-23891", "GHSA-fc46-r95f-hq7g" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-k1gk-pcda-a7cb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/51596?format=api", "vulnerability_id": "VCID-m38p-yqcn-nka4", "summary": "Decidim amendments can be accepted or rejected by anyone\n### Impact\n\nThe vulnerability allows any registered and authenticated user to\naccept or reject any amendments. The impact is on any users who\nhave created proposals where the amendments feature is enabled.\nThis also elevates the user accepting the amendment as the author\nof the original proposal as people amending proposals are provided\ncoauthorship on the coauthorable resources.\n\nThe only check done when accepting or rejecting amendments is whether\nthe amendment reactions are enabled for the component:\n- https://github.com/decidim/decidim/blob/9d6c3d2efe5a83bb02e095824ff5998d96a75eb7/decidim-core/app/permissions/decidim/permissions.rb#L107\n\nThe permission checks have been changed at 1b99136 which was\nintroduced in released version 0.19.0. I have not investigated\nwhether prior versions are also affected.\n\n### Patches\n\nNot available\n\n### Workarounds\n\nDisable amendment reactions for the amendable component (e.g. proposals).", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40869", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0004", "scoring_system": "epss", "scoring_elements": "0.12375", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40869" }, { "reference_url": "https://github.com/decidim/decidim", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/decidim/decidim" }, { "reference_url": "https://github.com/decidim/decidim/commit/1b99136a1c7aa02616a0b54a6ab88d12907a57a9", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-21T19:35:49Z/" } ], "url": "https://github.com/decidim/decidim/commit/1b99136a1c7aa02616a0b54a6ab88d12907a57a9" }, { "reference_url": "https://github.com/decidim/decidim/security/advisories/GHSA-w5xj-99cg-rccm", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-21T19:35:49Z/" } ], "url": "https://github.com/decidim/decidim/security/advisories/GHSA-w5xj-99cg-rccm" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2026-40869.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2026-40869.yml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40869", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40869" }, { "reference_url": "https://github.com/advisories/GHSA-w5xj-99cg-rccm", "reference_id": "GHSA-w5xj-99cg-rccm", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-w5xj-99cg-rccm" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/110365?format=api", "purl": "pkg:gem/decidim-core@0.30.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25zg-267g-w3cn" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/decidim-core@0.30.5" }, { "url": "http://public2.vulnerablecode.io/api/packages/110363?format=api", "purl": "pkg:gem/decidim-core@0.31.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25zg-267g-w3cn" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/decidim-core@0.31.1" } ], "aliases": [ "CVE-2026-40869", "GHSA-w5xj-99cg-rccm" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-m38p-yqcn-nka4" } ], "fixing_vulnerabilities": [], "risk_score": "4.0", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/decidim-core@0.23.4" }