https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T00:16:51.357282+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-201434 EUVD-2026-201434 2026-10-07T00:16:51.403661+00:00 EUVD-2026-201434 https://cve.radiocsirt.org/vuln/fkie_cve-2024-45594 fkie_cve-2024-45594 2026-10-07T00:16:51.403698+00:00

Decidim is a participatory democracy framework. The meeting embeds feature used in the online or hybrid meetings is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.28.3 and 0.29.0.

 https://cve.radiocsirt.org/vuln/ghsa-j4h6-gcj7-7v9v GHSA-j4h6-gcj7-7v9v — decidim-meetings Cross-site scripting vulnerability in the online or hybrid meeting embeds 2026-10-07T00:16:51.403740+00:00

Affected: RubyGems: decidim-meetings

### Impact

The meeting embeds feature used in the online or hybrid meetings is subject to potential XSS attack through a malformed URL.

### Patches

Not available

### Workarounds

Disable the creation of meetings by participants in the meeting component.

### References

OWASP ASVS v4.0.3-5.1.3

### Credits

This issue was discovered in a security audit organized by mitgestalten Partizipationsbüro against Decidim. The security audit was implemented by the Austrian Institute of Technology.