GHSA-j4h6-gcj7-7v9v
GitHub Security Advisory
decidim-meetings Cross-site scripting vulnerability in the online or hybrid meeting embeds
✓ GitHub Reviewed
MODERATE
Has CVE
Advisory Details
### Impact
The meeting embeds feature used in the online or hybrid meetings is subject to potential XSS attack through a malformed URL.
### Patches
Not available
### Workarounds
Disable the creation of meetings by participants in the meeting component.
### References
OWASP ASVS v4.0.3-5.1.3
### Credits
This issue was discovered in a security audit organized by mitgestalten Partizipationsbüro against Decidim. The security audit was implemented by the Austrian Institute of Technology.
Affected Packages
RubyGems
decidim-meetings
Affected versions:
0.28.0
(fixed in 0.28.3)
Related CVEs
Key Information
5.0
/10
Dataset
Last updated: July 13, 2025 6:03 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.