CyberRota Analysis
AI-GeneratedDecidim versions prior to 0.30.9, between 0.31.0 and 0.31.5, and 0.32.0.rc1 are vulnerable to a cross-site scripting (XSS) attack, allowing administrators with landing-page editing privileges to inject and execute arbitrary HTML and JavaScript in users' browsers. This flaw poses a medium severity risk, potentially leading to unauthorized actions or data exposure for users interacting with the platform. Organizations using affected versions should prioritize upgrading to the patched releases to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editing privileges can store arbitrary HTML and JavaScript in an HTML content block, which Decidim::ContentBlocks::HtmlCell#html_content renders without sanitization, causing the script to execute in visitors' browsers. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.