Medium
Decidim cross-site scripting (XSS) in the admin panel
Type: advisorySources: OSV
Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-27095
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 12:01 UTC · Revision 1
Source evidence
Decidim cross-site scripting (XSS) in the admin panel
core-osv · Original sourcePublished 10 Jul 2024, 19:07 UTC
Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1.
osv:CVE-2024-27095
Complete source record
{
"id": "27fe22a3db6add2a303568a31ddbba2028bde8257710eccc40b8d4bd621e1e9a",
"url": "https://osv.dev/vulnerability/CVE-2024-27095",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Decidim cross-site scripting (XSS) in the admin panel",
"summary": "Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. This vulnerability is fixed in 0.27.6 and 0.28.1.",
"evidence": "osv:CVE-2024-27095",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2024-27095",
"aliases": [
"CVE-2024-27095",
"GHSA-529p-jj47-w3m3"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/decidim/decidim",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "928259cd7f5711b70d71d2d7b14a260b4d74afdd"
},
{
"introduced": "94ca626c877af4a41ebbfe14b786ef3961bc66ba"
},
{
"fixed": "e1d4ac47979572676737df5b52bbabe7e3b844f7"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.27.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:decidim:decidim:0.28.0:-:*:*:*:ruby:*:*",
"range": [
{
"introduced": "0.28.0-NA"
},
{
"last_affected": "0.28.0-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:decidim:decidim:0.28.0:rc1:*:*:*:ruby:*:*",
"range": [
{
"introduced": "0.28.0-rc1"
},
{
"last_affected": "0.28.0-rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:decidim:decidim:0.28.0:rc2:*:*:*:ruby:*:*",
"range": [
{
"introduced": "0.28.0-rc2"
},
{
"last_affected": "0.28.0-rc2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:decidim:decidim:0.28.0:rc3:*:*:*:ruby:*:*",
"range": [
{
"introduced": "0.28.0-rc3"
},
{
"last_affected": "0.28.0-rc3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:decidim:decidim:0.28.0:rc4:*:*:*:ruby:*:*",
"range": [
{
"introduced": "0.28.0-rc4"
},
{
"last_affected": "0.28.0-rc4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:decidim:decidim:0.28.0:rc5:*:*:*:ruby:*:*",
"range": [
{
"introduced": "0.28.0-rc5"
},
{
"last_affected": "0.28.0-rc5"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "928259cd7f5711b70d71d2d7b14a260b4d74afdd"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.27.6"
},
{
"range": [
{
"fixed": "e1d4ac47979572676737df5b52bbabe7e3b844f7"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.28.1"
}
]
}
}
],
"versions": [
"0.28.0-NA",
"0.28.0-rc1",
"0.28.0-rc2",
"0.28.0-rc3",
"0.28.0-rc4",
"0.28.0-rc5",
"v0.28.0",
"v0.27.5",
"v0.27.4",
"v0.27.3",
"v0.27.2",
"v0.27.1",
"v0.27.0",
"v0.27.0.rc1",
"v0.20.0",
"v0.5.0",
"v0.4.0",
"v0.3.0",
"v0.2.0",
"v0.1.0",
"v0.0.8.1",
"v0.0.8",
"v0.0.7",
"v0.0.6",
"v0.0.5",
"v0.0.4",
"v0.0.3",
"v0.0.2",
"v0.0.1",
"v0.0.1.alpha9",
"v0.0.1.alpha8",
"v0.0.1.alpha7",
"v0.0.1.alpha6",
"v0.0.1.alpha5",
"v0.0.1.alpha4",
"v0.0.1.alpha3",
"v0.0.1.alpha2",
"v0.0.1.alpha1",
"v0.0.1.alpha"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-27095.json"
}
}
],
"modified": "2026-10-28T02:30:35.062521541Z",
"provider": "osv",
"references": [
"https://github.com/decidim/decidim/releases/tag/v0.27.6",
"https://github.com/decidim/decidim/releases/tag/v0.28.1",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27095.json",
"https://github.com/decidim/decidim/security/advisories/GHSA-529p-jj47-w3m3",
"https://nvd.nist.gov/vuln/detail/CVE-2024-27095"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27095.json"
}
},
"related_cves": [
{
"value": "CVE-2024-27095",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 502242,
"published_at": "2024-07-10T19:07:45.995+00:00"
}