What is GHSA-cc4g-m3g7-xmw8?

GHSA-cc4g-m3g7-xmw8 is a security advisory published by GitHub Security Advisories with High severity. Decidim has a cross-site scripting vulnerability in the version control page

Which CVE IDs does GHSA-cc4g-m3g7-xmw8 cover?

GHSA-cc4g-m3g7-xmw8 covers the following CVE IDs: CVE-2024-41673. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cc4g-m3g7-xmw8?

GHSA-cc4g-m3g7-xmw8 has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

Which products are affected by GHSA-cc4g-m3g7-xmw8?

GHSA-cc4g-m3g7-xmw8 affects 1 product, including: rubygems/decidim:\u003c= 0.27.7.

GHSA-cc4g-m3g7-xmw8HighCVSS 7.1

Decidim has a cross-site scripting vulnerability in the version control page

Vendor

GitHub Security Advisories

Published

October 1, 2024

Last Modified

October 3, 2024

🔗 CVE IDs covered (1)

CVE-2024-41673 →

📋 Description

Impact

The version control feature used in resources is subject to potential cross-site scripting (XSS) attack through a malformed URL.

Workarounds

Not available

References

OWASP ASVS v4.0.3-5.1.3

Credits

This issue was discovered in a security audit organized by Open Source Politics against Decidim done during July 2025.

🎯 Affected products1

rubygems/decidim:<= 0.27.7

🔗 References (5)

https://github.com/decidim/decidim/security/advisories/GHSA-cc4g-m3g7-xmw8
https://nvd.nist.gov/vuln/detail/CVE-2024-41673
https://github.com/decidim/decidim/commit/8a18c8b1ee85a1b35ee0d8d5893f218695d15637
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-41673.yml
https://github.com/advisories/GHSA-cc4g-m3g7-xmw8