decidim-core
RubyGems9 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting decidim-corepage 1 of 1
- CVE-2023-32693HIGHCVSS 8.1EG 8.1✓ Fixed in 0.26.72023-07-11
vulnerable: 0.25.0 ... 0.26.5 (11 versions)
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The external link feature is susceptible to cross-site scripting. Th…
- CVE-2023-34089HIGHCVSS 8.1EG 8.1✓ Fixed in 0.27.32023-07-11
vulnerable: 0.27.0, 0.27.1, 0.27.2
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The processes filter feature is susceptible to Cross-site scripting.…
- CVE-2023-51447MEDIUMCVSS 6.3EG 6.3✓ Fixed in 0.27.52024-02-20
vulnerable: 0.27.0, 0.27.1, 0.27.2, 0.27.3, 0.27.4
Decidim is a participatory democracy framework. Starting in version 0.27.0 and prior to versions 0.27.5 and 0.28.0, the dynamic file upload feature is subject to potential cross-site scripting attacks in case the attacker manages to modify…
- CVE-2025-65017MEDIUMCVSS 6.5EG 6.5✓ Fixed in 0.30.42026-02-03
vulnerable: 0.30.0, 0.30.1, 0.30.2, 0.30.3
Decidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0, the private data exports can lead to data leaks in case the UUID generation, causing collisions for the generate…
- CVE-2026-23891HIGHCVSS 8.7EG 8.7✓ Fixed in 0.30.52026-04-13
vulnerable: 0.0.1 ... 0.9.3 (158 versions)
Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context …
- CVE-2026-40869HIGHCVSS 7.5EG 7.5✓ Fixed in 0.30.52026-04-21
vulnerable: 0.19.0 ... 0.30.4 (81 versions)
Decidim is a participatory democracy framework. Starting in version 0.19.0 and prior to versions 0.30.5 and 0.31.1, a vulnerability allows any registered and authenticated user to accept or reject any amendments. The impact is on any users…
- CVE-2026-45377MEDIUMCVSS 6.5EG 6.5✓ Fixed in 0.32.02026-07-13
vulnerable: 0.32.0.rc1, 0.32.0.rc2, 0.32.0.rc3
Decidim: Private exports can be downloaded through reusable links ## Description The normal `download_your_data` flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be r…
- CVE-2026-45572MEDIUMCVSS 4.8EG 4.8✓ Fixed in 0.32.02026-07-13
vulnerable: 0.32.0.rc1, 0.32.0.rc2, 0.32.0.rc3
Decidim: HTML content blocks allow stored script execution ## Description A privileged admin user who can edit an affected landing page can store arbitrary HTML/JavaScript in an `HTML block`, and the public page renders it with `html_sa…
- CVE-2026-45573MEDIUMCVSS 6.4EG 6.4✓ Fixed in 0.32.02026-07-13
vulnerable: 0.32.0.rc1, 0.32.0.rc2, 0.32.0.rc3
Decidim: Push subscriptions can be abused for server-side requests ## Description The push-subscription endpoint stores an attacker-controlled delivery URL, and the notification send path becomes an outbound-request sink when VAPID deliv…
Check whether decidim-core is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for decidim-core CVEs against the assets you own.
Start Free Scan →