{"action":"Upgrade decidim to 0.27.8 or later.","affected":[{"fixed":"0.27.8","introduced":"0"}],"component":"decidim","cve_ids":["CVE-2024-41673"],"ecosystem":"RubyGems","epss":0.00424,"exploited":false,"fixed_versions":["0.27.8"],"ghsa_id":"GHSA-cc4g-m3g7-xmw8","id":"tcs_01M5KEJP9CBR5K1JVS8K3RFHJH","modified_at":"2024-10-03T13:39:21.865953Z","published_at":"2024-10-01T18:14:54Z","references":["https://osv.dev/vulnerability/GHSA-cc4g-m3g7-xmw8","https://github.com/decidim/decidim/security/advisories/GHSA-cc4g-m3g7-xmw8","https://nvd.nist.gov/vuln/detail/CVE-2024-41673","https://github.com/decidim/decidim/commit/8a18c8b1ee85a1b35ee0d8d5893f218695d15637","https://github.com/decidim/decidim","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-41673.yml"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-cc4g-m3g7-xmw8","url":"https://osv.dev/vulnerability/GHSA-cc4g-m3g7-xmw8"}],"summary":"Decidim has a cross-site scripting vulnerability in the version control page"}