{"id":"CVE-2023-34089","aliases":["GHSA-5652-92r9-3fx9"],"url":"https://o3.security/vulnerability/CVE-2023-34089","summary":"Decidim Cross-site Scripting vulnerability in the processes filter","details":"Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was patched in version 0.27.3 and 0.26.7.\n","published":"2023-07-11T17:36:14.670Z","modified":"2026-08-12T03:51:47.907006800Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"},"epss":{"score":0.00736,"percentile":0.52826,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"decidim","fixedVersion":"0.26.7"},{"ecosystem":"RubyGems","name":"decidim","fixedVersion":"0.27.3"},{"ecosystem":"RubyGems","name":"decidim-core","fixedVersion":"0.26.7"},{"ecosystem":"RubyGems","name":"decidim-core","fixedVersion":"0.27.3"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/decidim/decidim/releases/tag/v0.26.6"},{"type":"WEB","url":"https://github.com/decidim/decidim/releases/tag/v0.27.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34089.json"},{"type":"ADVISORY","url":"https://github.com/decidim/decidim/security/advisories/GHSA-5652-92r9-3fx9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34089"},{"type":"PACKAGE","url":"https://github.com/decidim/decidim"},{"type":"WEB","url":"https://github.com/decidim/decidim/releases/tag/v0.26.7"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2023-34089.yml"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2023-34089.yml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:47.907006800Z"}}