Decidim HTML Content Blocks Vulnerability: Potential Script Execution
An early warning has been issued regarding a vulnerability in the Decidim gem that allows privileged admin users to store arbitrary HTML/JavaScript in HTML content blocks, which may execute in visitors' browsers.
What happened
The vulnerability, tracked as GHSA-533C-2VH9-4R86, affects various versions of the Decidim gem. It is reported that a privileged admin user can store arbitrary HTML/JavaScript in an HTML block on an affected landing page, which could execute in visitor's browsers. Exploitation of this vulnerability requires administrative access. It is recommended not to grant admin permissions to non-trustful users to mitigate potential risks.
Affected versions include multiple ranges from 0.14.0 to 0.32.0.rc3, with specific fixed versions noted for certain ranges. Users are advised to consult the primary sources for detailed version information and to apply necessary updates or patches as they become available.
This incident is currently under investigation, and further details may emerge. Users of the Decidim gem are encouraged to review their configurations and access controls to ensure they are not vulnerable to this potential attack vector.
How 0Day mitigates this
decidim is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.