Description
Decidim is a participatory democracy framework. The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter `per_page`. This vulnerability is fixed in 0.27.6 and 0.28.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| decidim | decidim | < 0.27.6, >= 0.28.0.rc1, < 0.28.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | decidim | < 0.27.6 | 0.27.6 | GHSA-7cx8-44pc-xv3q |
| RubyGems | decidim | >= 0.28.0.rc1, < 0.28.1 | 0.28.1 | GHSA-7cx8-44pc-xv3q |