CVE-2024-39910 json
Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editor
published 2024-09-16 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-2881 , GHSA-vvqw-fqwx-mqmm
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded to the server. The attacker is able to change e.g. to <svg onload=alert('XSS')> if they know how to craft these requests themselves. This issue has been addressed in release version 0.27.7. All users are advised to upgrade. Users unable to upgrade should review the user accounts that have access to the admin panel (i.e. general Administrators, and participatory space's Administrators) and remove access to them if they don't need it. Disable the "Enable rich text editor for participants" setting in the admin dashboard
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N |
| NVD | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | decidim | <0.27.7 |
0.27.7 |
Affected products
- decidim decidim
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/decidim/decidim/commit/47adca81cabea898005ec07b130b008f2a2be99f
web, patch
-
github.com
/decidim/decidim/security/advisories/GHSA-vvqw-fqwx-mqmm
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-39910
advisory
-
github.com
/decidim/decidim
package
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-39910.yml
web
Sources
- CVE List CVE-2024-39910
- GitHub Advisory GHSA-vvqw-fqwx-mqmm
- NVD CVE-2024-39910
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.