Read the docs
TI-2024-26804 Aliases CVE-2024-39910GHSA-vvqw-fqwx-mqmm

Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editor

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded to the server. The attacker is able to change e.g. to <svg onload=alert('XSS')> if they know how to craft these requests themselves. This issue has been addressed in release version 0.27.7. All users are advised to upgrade. Users unable to upgrade should review the user accounts that have access to the admin panel (i.e. general Administrators, and participatory space's Administrators) and remove access to them if they don't need it. Disable the "Enable rich text editor for participants" setting in the admin dashboard

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00275 20th percentileScored 2026-11-07
Fix Fixed decidim (decidim): 0.27.7decidim (RubyGems): 0.27.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
decidimdecidimbefore 0.27.70.27.7Patch availableCNA
—decidim (RubyGems)before 0.27.70.27.7Patch availableGHSA-vvqw-fqwx-mqmm
  • decidim Vendordecidim Affected before 0.27.7 Fixed in 0.27.7 Patch available CNA
  • decidim (RubyGems) Vendor— Affected before 0.27.7 Fixed in 0.27.7 Patch available GHSA-vvqw-fqwx-mqmm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:*before 0.27.7Vulnerabledecidim
  • cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:* Versions before 0.27.7 Vulnerable ·decidim

Remediation

  • Fix · CNA decidim (decidim) Fixed in 0.27.7
  • Fix · GHSA-vvqw-fqwx-mqmm decidim (RubyGems) Fixed in 0.27.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-39910
  2. 2026-10-03 Alias added: GHSA-vvqw-fqwx-mqmm

References

Patch 1

Advisory 2

Other 2

  • TI-2025-40203 Decidim's private data exports can lead to data leaks CVSS 4.0HIGH 8.2
  • TI-2023-16936 Decidim vulnerable to sensitive data disclosure CVSS 3.1HIGH 7.5
  • TI-2026-19249 Decidim has a Cross-site scripting (XSS) vulnerability via user name field CVSS 4.0CRITICAL 9.3
  • TI-2023-18306 Decidim has broken access control in templates CVSS 3.1CRITICAL 9.1
  • TI-2023-16935 Decidim Cross-site Scripting vulnerability in the processes filter CVSS 3.1HIGH 8.1
  • TI-2023-15969 Decidim Cross-site Scripting vulnerability in the external link redirections CVSS 3.1HIGH 8.1
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences