This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.
Description
Decidim is a participatory democracy framework. Prior to 0.32.0, a low-privilege process-scoped administrator or election editor with question-management rights can store HTML or script-bearing content in question.body. The question_title helper returns the translatable question body through html_safe without a sanitization boundary, causing stored script execution when visitors open public election pages or voting booth screens. The persisted script executes in visitors' browsers. The vulnerability is fixed in 0.32.0.
A stored cross-site scripting vulnerability has been identified in the Decidim participatory democracy framework, specifically in versions prior to 0.32.0 of the Decidim Elections module. The issue arises when a low-privilege, process-scoped administrator or election editor with question-management rights can inject HTML or scripts into the question body. This unsanitized content is then executed as a script in the browsers of visitors viewing public election pages or voting booth screens.
Users can update to Decidim version 0.32.0 or later, where this vulnerability has been fixed.
To update, follow these steps:
1. Update your ruby version
If you're using rbenv, this is done with the following commands:
```shell
rbenv install 3.4.7
rbenv local 3.4.7
```
You may need to change your `.ruby-version` file too.
If not, you need to adapt it to your environment, for instance by changing the decidim docker image to use ruby:3.4.7.
2. Update your Gemfile
```ruby
gem "decidim", "0.32.0"
gem "decidim-dev", "0.32.0"
```
3. Run these commands
```shell
sudo apt install libvips libvips-tools # or the alternative installation process for your operating system. See "3.4. Replace image processing with imagemagick to libvips"
bundle update decidim
bin/rails decidim:upgrade
sed -i "s/config\.load_defaults [0-9]\+\.[0-9]\+/config.load_defaults 8.1/g" config/application.rb # see "2.1. Ruby on Rails update to 8.1"
wget https://raw.githubusercontent.com/decidim/decidim/refs/heads/release/0.32-stable/decidim-core/lib/decidim/shakapacker/shakapacker.yml -O config/shakapacker.yml -O config/shakapacker.yml # see "2.3. Shakapacker upgrade"
bin/rails db:migrate
bin/rails decidim:upgrade:encryption # see "5.1. Encryption mechanism changes"
echo "/public/sw.js*" >> .gitignore # see "2.5. Fix gitignore for ServiceWorker related files"
bin/rails decidim:upgrade:remove_deleted_users_left_data # see "3.1. Remove user data left behind by `Decidim::DestroyAccount`"
bin/rails decidim:upgrade:fix_deleted_members_follows # see "3.2. Remove the follows of former private users"
sed -i 's/Env.new("SMTP_STARTTLS_AUTO").to_boolean_string/Env.new("SMTP_STARTTLS_AUTO", true).present?/' config/environments/production.rb # see "3.5. Fix the "SMTP_STARTTLS_AUTO" env var in `production.rb`"
bin/rails data:migrate
```
In cases where you have done some developments, please check out these particular sections:
* run your test suite and be aware that there may be some incompatibilities with the Rails 8.1 update (see "2.1. Ruby on Rails update to 8.1")
* if you use Azure for your Active Storage configuration, you need to use another gem (see "2.1.1 Removal of official Azure support from Active Storage")
* if your tests had hard-coded URLs you may need to change them to use the URL helper (i.e. use "some_route_path" instead of "/some/route")
* if you were defining some configure block (like `Decidim::YourModule.configure do |config|`), you need to migrate to the new patter described at "5.3. Decidim Configuration changes"
Decidim Elections
< 0.32.0 (semver)
CPE
No CPEs found in CPE dictionary for this product.
Remediation
Upgrade: 0.32.0moderate effort
To update, follow these steps:
1. Update your ruby version
If you're using rbenv, this is done with the following commands:
```shell
rbenv install 3.4.7
rbenv local 3.4.7
```
You may need to change your `.ruby-version` file too.
If not, you need to adapt it to your environment, for instance by changing the decidim docker image to use ruby:3.4.7.
2. Update your Gemfile
```ruby
gem "decidim", "0.32.0"
gem "decidim-dev", "0.32.0"
```
3. Run these commands
```shell
sudo apt install libvips libvips-tools # or the alternative installation process for your operating system. See "3.4. Replace image processing with imagemagick to libvips"
bundle update decidim
bin/rails decidim:upgrade
sed -i "s/config\.load_defaults [0-9]\+\.[0-9]\+/config.load_defaults 8.1/g" config/application.rb # see "2.1. Ruby on Rails update to 8.1"
wget https://raw.githubusercontent.com/decidim/decidim/refs/heads/release/0.32-stable/decidim-core/lib/decidim/shakapacker/shakapacker.yml -O config/shakapacker.yml -O config/shakapacker.yml # see "2.3. Shakapacker upgrade"
bin/rails db:migrate
bin/rails decidim:upgrade:encryption # see "5.1. Encryption mechanism changes"
echo "/public/sw.js*" >> .gitignore # see "2.5. Fix gitignore for ServiceWorker related files"
bin/rails decidim:upgrade:remove_deleted_users_left_data # see "3.1. Remove user data left behind by `Decidim::DestroyAccount`"
bin/rails decidim:upgrade:fix_deleted_members_follows # see "3.2. Remove the follows of former private users"
sed -i 's/Env.new("SMTP_STARTTLS_AUTO").to_boolean_string/Env.new("SMTP_STARTTLS_AUTO", true).present?/' config/environments/production.rb # see "3.5. Fix the "SMTP_STARTTLS_AUTO" env var in `production.rb`"
bin/rails data:migrate
```
In cases where you have done some developments, please check out these particular sections:
* run your test suite and be aware that there may be some incompatibilities with the Rails 8.1 update (see "2.1. Ruby on Rails update to 8.1")
* if you use Azure for your Active Storage configuration, you need to use another gem (see "2.1.1 Removal of official Azure support from Active Storage")
* if your tests had hard-coded URLs you may need to change them to use the URL helper (i.e. use "some_route_path" instead of "/some/route")
* if you were defining some configure block (like `Decidim::YourModule.configure do |config|`), you need to migrate to the new patter described at "5.3. Decidim Configuration changes"
Volerion