Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1jYzRnLW0zZzcteG13OM4AA_5i

Decidim has a cross-site scripting vulnerability in the version control page

Impact

The version control feature used in resources is subject to potential cross-site scripting (XSS) attack through a malformed URL.

Workarounds

Not available

References

OWASP ASVS v4.0.3-5.1.3

Credits

This issue was discovered in a security audit organized by Open Source Politics against Decidim done during July 2025.

Permalink: https://github.com/advisories/GHSA-cc4g-m3g7-xmw8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jYzRnLW0zZzcteG13OM4AA_5i
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 3 months ago
Updated: 3 months ago

CVSS Score: 7.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

EPSS Percentage: 0.00043
EPSS Percentile: 0.10511

Identifiers: GHSA-cc4g-m3g7-xmw8, CVE-2024-41673
References:

• https://github.com/decidim/decidim/security/advisories/GHSA-cc4g-m3g7-xmw8
• https://nvd.nist.gov/vuln/detail/CVE-2024-41673
• https://github.com/decidim/decidim/commit/8a18c8b1ee85a1b35ee0d8d5893f218695d15637
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-41673.yml
• https://github.com/advisories/GHSA-cc4g-m3g7-xmw8

Repository: https://github.com/decidim/decidim
Blast Radius: 17.7

Affected Packages