{"action":"Upgrade decidim to 0.27.7 or later.","affected":[{"fixed":"0.27.7","introduced":"0"}],"component":"decidim","cve_ids":["CVE-2024-39910"],"ecosystem":"RubyGems","epss":0.00275,"exploited":false,"fixed_versions":["0.27.7"],"ghsa_id":"GHSA-vvqw-fqwx-mqmm","id":"tcs_01M5KENQ132HR36MHJP02P20K0","modified_at":"2024-09-17T22:34:04.027787Z","published_at":"2024-09-16T17:17:54Z","references":["https://osv.dev/vulnerability/GHSA-vvqw-fqwx-mqmm","https://github.com/decidim/decidim/security/advisories/GHSA-vvqw-fqwx-mqmm","https://nvd.nist.gov/vuln/detail/CVE-2024-39910","https://github.com/decidim/decidim/commit/47adca81cabea898005ec07b130b008f2a2be99f","https://github.com/decidim/decidim","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-39910.yml"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-vvqw-fqwx-mqmm","url":"https://osv.dev/vulnerability/GHSA-vvqw-fqwx-mqmm"}],"summary":"Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor"}