Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
CVE-2024-39910: QuillJS editor in Decidim can be hacked remotely
CVE-2024-39910 · published 2 years ago
Summary
Decidim's QuillJS editor allows attackers to inject malicious code, potentially allowing them to take control of the website. This is fixed in version 0.27.7, so upgrade to this version to stay secure. If you can't upgrade, review and limit access to admin accounts and disable rich text editing for participants.
What to do
- Update josep jaume rey peroy decidim to version 0.27.7.
- Update decidim decidim to version 0.27.7 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rubygems | josep jaume rey peroy | decidim |
<= 0.27.6 Fix: upgrade to 0.27.7
|
| – | decidim | decidim |
< 0.27.7 cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:* |
Original advisory text
Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editor
decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded to the server. The attacker is able to change e.g. to <svg onload=alert('XSS')> if they know how to craft these requests themselves. This issue has been addressed in release version 0.27.7. All users are advised to upgrade. Users unable to upgrade should review the user accounts that have access to the admin panel (i.e. general Administrators, and participatory space's Administrators) and remove access to them if they don't need it. Disable the "Enable rich text editor for participants" setting in the admin dashboard
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-39910 Vendor Advisory
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-39...
- https://github.com/advisories/GHSA-vvqw-fqwx-mqmm
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39910... Vendor Advisory
- https://github.com/decidim/decidim/security/advisories/GHSA-vvqw-fqwx-mqmm Vendor Advisory
- https://github.com/decidim/decidim/commit/47adca81cabea898005ec07b130b008f2a2be9... Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published16 Sep 2024
Updated3 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta