CVE-2026-45572: falha de média gravidade em decidim
Decidim: HTML content blocks allow stored script execution
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.8epss 0.3%
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editing privileges can store arbitrary HTML and JavaScript in an HTML content block, which Decidim::ContentBlocks::HtmlCell#html_content renders without sanitization, causing the script to execute in visitors' browsers. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
decidim · decidimCVEs relacionadas — decidim
No mesmo produto, das mais perigosas para as menos.
CVE-2023-34090HIGHDecidim vulnerable to sensitive data disclosureEPSS 1.3%CVE-2023-32693HIGHDecidim Cross-site Scripting vulnerability in the external link redirectionsEPSS 0.8%CVE-2023-48220MEDIUMDecidim's devise_invitable gem vulnerable to circumvention of invitation token expiry periodEPSS 0.8%CVE-2023-34089HIGHDecidim Cross-site Scripting vulnerability in the processes filterEPSS 0.7%CVE-2023-36465CRITICALDecidim has broken access control in templatesEPSS 0.7%CVE-2026-45376MEDIUMDecidim: Admin user search allows SQL injection through similarity-based sortingEPSS 0.6%