CVE-2023-36825 Information

Description

Decidim is a participatory democracy framework written in Ruby on Rails originally developed for the Barcelona City government online and offline participation website. This vulnerability is related to the deserialization of untrusted data from the _state query parameter which can result in remote code execution. The issue has been addressed in version 14.5.0. Users are advised to upgrade their software to this version or any subsequent versions that include the patch.

Reference

https://github.com/orchidsoftware/platform/security/advisories/GHSA-ph6g-p72v-pc3p https://github.com/orchidsoftware/platform/releases/tag/14.5.0