Search for packages
| purl | pkg:gem/decidim-core@0.0.1.alpha5 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-duuc-4122-tfha
Aliases: CVE-2023-34089 GHSA-5652-92r9-3fx9 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was patched in version 0.27.3 and 0.26.7. |
Affected by 6 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-m6gy-ubmr-x7ak
Aliases: CVE-2026-23891 GHSA-fc46-r95f-hq7g |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
|
|
VCID-urku-ttg6-1uen
Aliases: CVE-2023-51447 GHSA-9w99-78rj-hmxq |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Decidim is a participatory democracy framework. Starting in version 0.27.0 and prior to versions 0.27.5 and 0.28.0, the dynamic file upload feature is subject to potential cross-site scripting attacks in case the attacker manages to modify the file names of the records being uploaded to the server. This appears in sections where the user controls the file upload dialogs themselves and has the technical knowledge to change the file names through the dynamic upload endpoint. Therefore I believe it would require the attacker to control the whole session of the particular user but in any case, this needs to be fixed. Successful exploit of this vulnerability would require the user to have successfully uploaded a file blob to the server with a malicious file name and then have the possibility to direct the other user to the edit page of the record where the attachment is attached. The users are able to craft the direct upload requests themselves controlling the file name that gets stored to the database. The attacker is able to change the filename e.g. to `<svg onload=alert('XSS')>` if they know how to craft these requests themselves. And then enter the returned blob ID to the form inputs manually by modifying the edit page source. Versions 0.27.5 and 0.28.0 contain a patch for this issue. As a workaround, disable dynamic uploads for the instance, e.g. from proposals. |
Affected by 4 other vulnerabilities. |
|
VCID-ydvj-rmfn-8uaz
Aliases: CVE-2023-32693 GHSA-469h-mqg8-535r |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The external link feature is susceptible to cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was patched in versions 0.27.3 and 0.26.7. |
Affected by 6 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-z21p-469r-bkfx
Aliases: CVE-2025-65017 GHSA-3cx6-j9j4-54mp |
Decidim's private data exports can lead to data leaks Private data exports can lead to data leaks in cases where the UUID generation causes collisions for the generated UUIDs. The bug was introduced by #13571 and affects Decidim versions 0.30.0 or newer (currently 2025-09-23). This issue was discovered by running the following spec several times in a row, as it can randomly fail due to this bug: ```bash $ cd decidim-core $ for i in {1..10}; do bundle exec rspec spec/jobs/decidim/download_your_data_export_job_spec.rb -e "deletes the" || break ; done ``` Run the spec as many times as needed to hit a UUID that converts to `0` through `.to_i`. The UUID to zero conversion does not cause a security issue but the security issue is demonstrated with the following example. The following code regenerates the issue by assigning a predefined UUID that will generate a collision (example assumes there are already two existing users in the system): ```ruby |
Affected by 3 other vulnerabilities. Affected by 3 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-01T10:42:43.537646+00:00 | GitLab Importer | Affected by | VCID-m6gy-ubmr-x7ak | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/decidim-core/CVE-2026-23891.yml | 38.6.0 |
| 2026-05-31T10:20:38.956842+00:00 | Ruby Importer | Affected by | VCID-z21p-469r-bkfx | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2025-65017.yml | 38.6.0 |
| 2026-05-31T10:19:24.051622+00:00 | Ruby Importer | Affected by | VCID-urku-ttg6-1uen | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2023-51447.yml | 38.6.0 |
| 2026-05-31T10:18:58.659250+00:00 | Ruby Importer | Affected by | VCID-duuc-4122-tfha | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2023-34089.yml | 38.6.0 |
| 2026-05-31T10:18:56.802122+00:00 | Ruby Importer | Affected by | VCID-ydvj-rmfn-8uaz | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2023-32693.yml | 38.6.0 |