PT-2024-29498 · Decidim · Decidim

Published 2024-10-01 · Updated 2024-10-20 · CVE-2024-41673

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.27.8

Description The version control feature in Decidim is subject to a potential cross-site scripting (XSS) attack through a malformed URL. This issue was discovered during a security audit organized by Open Source Politics against Decidim in July 2025.

Recommendations For versions prior to 0.27.8, update to version 0.27.8 to resolve the issue. As a temporary workaround, consider restricting access to the version control feature until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-41673

GHSA-CC4G-M3G7-XMW8

Affected Products

Decidim

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41673.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-41673.yml · Exploit
• https://osv.dev/vulnerability/CVE-2024-41673 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cc4g-m3g7-xmw8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41673 · Security Note
• https://github.com/decidim/decidim · Note
• https://github.com/decidim/decidim/security/advisories/GHSA-cc4g-m3g7-xmw8 · Note
• https://github.com/decidim/decidim/commit/8a18c8b1ee85a1b35ee0d8d5893f218695d15637 · Note
• https://t.me/cvedetector/6761 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1841235586411110404 · Twitter Post
• https://twitter.com/TechTweetBot/status/1841756059750351046 · Twitter Post
• https://twitter.com/CVEnew/status/1841135264879550808 · Twitter Post
• https://twitter.com/imabit_inc/status/1848103698024526066 · Twitter Post
• https://t.me/latest_high_impact_cve/1245 · Telegram Post