5 known security vulnerabilities

  • criticalGHSA-fc46-r95f-hq7g(CVE-2026-23891)

    Decidim has a cross-site scripting (XSS) in user name

Show 4 more vulnerabilities
1 high3 moderate
  • highGHSA-w5xj-99cg-rccm(CVE-2026-40869)

    Decidim amendments can be accepted or rejected by anyone

  • moderateGHSA-2g9c-vf8h-prxx(CVE-2026-45573)

    Decidim: Push subscriptions can be abused for server-side requests

  • moderateGHSA-533c-2vh9-4r86(CVE-2026-45572)

    Decidim: HTML content blocks allow stored script execution

  • moderateGHSA-767h-63j4-5226(CVE-2026-45377)

    Decidim: Private exports can be downloaded through reusable links

Adds core features so other engines can hook into the framework.

Required Ruby Version

~> 3.2.0

Authors

Josep Jaume Rey Peroy, Marc Riera Casals, Oriol Gual Oliva

Versions

  1. 0.32.1

    1. source

      1. 0.32.1 source July 30, 2026 (10.1 MB)
  2. 0.32.0

    1. source

      1. 0.32.0 source July 02, 2026 (10.1 MB)
  3. 0.32.0.rc3

    1. source

      1. 0.32.0.rc3 source June 02, 2026 (10.1 MB)
  4. 0.32.0.rc2

    1. source

      1. 0.32.0.rc2 source May 12, 2026 (10.1 MB)
  5. 0.32.0.rc1

    1. source

      1. 0.32.0.rc1 source April 24, 2026 (10.1 MB)
  6. 0.29.2

    1. source

      1. 0.29.2 source February 12, 2025 (9.86 MB)
Show all versions (186 total)

Pushed by

andreslucena

SHA 256 checksum

← Previous version Next version →