{"id":"CVE-2023-32693","aliases":["GHSA-469h-mqg8-535r"],"url":"https://o3.security/vulnerability/CVE-2023-32693","summary":"Decidim Cross-site Scripting vulnerability in the external link redirections","details":"Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The external link feature is susceptible to cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was patched in versions 0.27.3 and 0.26.7.","published":"2023-07-11T17:19:26.138Z","modified":"2026-08-07T11:49:01.521485371Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"decidim","fixedVersion":"0.26.7"},{"ecosystem":"RubyGems","name":"decidim-core","fixedVersion":"0.27.3"},{"ecosystem":"RubyGems","name":"decidim-core","fixedVersion":"0.26.7"},{"ecosystem":"RubyGems","name":"decidim","fixedVersion":"0.27.3"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/decidim/decidim/releases/tag/v0.26.7"},{"type":"WEB","url":"https://github.com/decidim/decidim/releases/tag/v0.27.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32693.json"},{"type":"ADVISORY","url":"https://github.com/decidim/decidim/security/advisories/GHSA-469h-mqg8-535r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32693"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T11:49:01.521485371Z"}}