CVE-2023-32693

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.26.7 Decidim versions prior to 0.27.3

Description The external link feature in Decidim is susceptible to cross-site scripting, allowing a remote attacker to execute JavaScript code in the context of a currently logged-in user. This could be used to make other users endorse or support proposals they have no intention of supporting or endorsing.

Recommendations For versions prior to 0.26.7, update to version 0.26.7 or later. For versions prior to 0.27.3, update to version 0.27.3 or later. As a temporary workaround, consider restricting the use of the external link feature until a patch is applied.