deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-m63j-wh5w-c252
Package: actionview (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 5.1.0, <= 5.1.6.1
Patched in: 5.1.6.2

Summary: Denial of Service Vulnerability in Action View

Details:
# Denial of Service Vulnerability in Action View

Impact 
------ 
Specially crafted accept headers can cause the Action View template location code to consume 100% CPU, causing the server unable to process requests.  This impacts all Rails applications that render views. 

All users running an affected release should either upgrade or use one of the workarounds immediately. 

Releases 
-------- 
The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations. 

Workarounds 
----------- 
This vulnerability can be mitigated by wrapping `render` calls with `respond_to` blocks.  For example, the following example is vulnerable: 

``` ruby
class UserController < ApplicationController 
  def index 
    render "index" 
  end 
end 
``` 

But the following code is not vulnerable: 

```ruby 
class UserController < ApplicationController 
  def index 
    respond_to |format| 
      format.html { render "index" } 
    end 
  end 
end 
``` 

Implicit rendering is impacted, so this code is vulnerable: 

```ruby 
class UserController < ApplicationController 
  def index 
  end 
end 
``` 

But can be changed this this: 

```ruby 
class UserController < ApplicationController 
  def index 
    respond_to |format| 
      format.html { render "index" } 
    end 
  end 
end 
``` 

Alternatively to specifying the format, the following monkey patch can be applied in an initializer: 

``` 
$ cat config/initializers/formats_filter.rb 
# frozen_string_literal: true 

ActionDispatch::Request.prepend(Module.new do 
  def formats 
    super().select do |format| 
      format.symbol || format.ref == "*/*" 
    end 
  end 
end) 
``` 

Please note that only the 5.2.x, 5.1.x, 5.0.x, and 4.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases. 

Also note that the patches for this vulnerability are the same as CVE-2019-5418. 

Credits 
------- 
Thanks to John Hawthorn <john@hawthorn.email> of GitHub
GitHub Security Advisory: GHSA-xq5j-gw7f-jgj8
Package: actionview (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 6.0.0, <= 6.0.3
Patched in: 6.0.3.1

Summary: CSRF Vulnerability in rails-ujs

Details:
There is a vulnerability in rails-ujs that allows attackers to send CSRF tokens to wrong domains.

Versions Affected:  rails <= 6.0.3
Not affected:       Applications which don't use rails-ujs.
Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1

Impact
------

This is a regression of CVE-2015-1840.

In the scenario where an attacker might be able to control the href attribute of an anchor tag or the action attribute of a form tag that will trigger a POST action, the attacker can set the href or action to a cross-origin URL, and the CSRF token will be sent.

Workarounds
-----------

To work around this problem, change code that allows users to control the href attribute of an anchor tag or the action attribute of a form tag to filter the user parameters.

For example, code like this:

    link_to params

to code like this:

    link_to filtered_params

    def filtered_params
      # Filter just the parameters that you trust
    end
GitHub Security Advisory: GHSA-xq5j-gw7f-jgj8
Package: actionview (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 5.0.0, <= 5.2.4.2
Patched in: 5.2.4.3

Summary: CSRF Vulnerability in rails-ujs

Details:
There is a vulnerability in rails-ujs that allows attackers to send CSRF tokens to wrong domains.

Versions Affected:  rails <= 6.0.3
Not affected:       Applications which don't use rails-ujs.
Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1

Impact
------

This is a regression of CVE-2015-1840.

In the scenario where an attacker might be able to control the href attribute of an anchor tag or the action attribute of a form tag that will trigger a POST action, the attacker can set the href or action to a cross-origin URL, and the CSRF token will be sent.

Workarounds
-----------

To work around this problem, change code that allows users to control the href attribute of an anchor tag or the action attribute of a form tag to filter the user parameters.

For example, code like this:

    link_to params

to code like this:

    link_to filtered_params

    def filtered_params
      # Filter just the parameters that you trust
    end
GitHub Security Advisory: GHSA-jp5v-5gx4-jmj9
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 6.0.0, <= 6.0.3
Patched in: 6.0.3.1

Summary: Ability to forge per-form CSRF tokens in Rails

Details:
It is possible to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token for any action for that session.

Impact
------

Given the ability to extract the global CSRF token, an attacker would be able to construct a per-form CSRF token for that session.

Workarounds
-----------

This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.
GitHub Security Advisory: GHSA-jp5v-5gx4-jmj9
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 5.0.0, <= 5.2.4.2
Patched in: 5.2.4.3

Summary: Ability to forge per-form CSRF tokens in Rails

Details:
It is possible to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token for any action for that session.

Impact
------

Given the ability to extract the global CSRF token, an attacker would be able to construct a per-form CSRF token for that session.

Workarounds
-----------

This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.
GitHub Security Advisory: GHSA-8727-m6gj-mc37
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 6.0.0, <= 6.0.3
Patched in: 6.0.3.1

Summary: Possible Strong Parameters Bypass in ActionPack

Details:
There is a strong parameters bypass vector in ActionPack.

Versions Affected:  rails <= 6.0.3
Not affected:       rails < 5.0.0
Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1

Impact
------
In some cases user supplied information can be inadvertently leaked from
Strong Parameters.  Specifically the return value of `each`, or `each_value`,
or `each_pair` will return the underlying "untrusted" hash of data that was
read from the parameters.  Applications that use this return value may be
inadvertently use untrusted user input.

Impacted code will look something like this:

```
def update
  # Attacker has included the parameter: `{ is_admin: true }`
  User.update(clean_up_params)
end

def clean_up_params
   params.each { |k, v|  SomeModel.check(v) if k == :name }
end
```

Note the mistaken use of `each` in the `clean_up_params` method in the above
example.

Workarounds
-----------
Do not use the return values of `each`, `each_value`, or `each_pair` in your
application.
GitHub Security Advisory: GHSA-8727-m6gj-mc37
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 5.0.0, <= 5.2.4.2
Patched in: 5.2.4.3

Summary: Possible Strong Parameters Bypass in ActionPack

Details:
There is a strong parameters bypass vector in ActionPack.

Versions Affected:  rails <= 6.0.3
Not affected:       rails < 5.0.0
Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1

Impact
------
In some cases user supplied information can be inadvertently leaked from
Strong Parameters.  Specifically the return value of `each`, or `each_value`,
or `each_pair` will return the underlying "untrusted" hash of data that was
read from the parameters.  Applications that use this return value may be
inadvertently use untrusted user input.

Impacted code will look something like this:

```
def update
  # Attacker has included the parameter: `{ is_admin: true }`
  User.update(clean_up_params)
end

def clean_up_params
   params.each { |k, v|  SomeModel.check(v) if k == :name }
end
```

Note the mistaken use of `each` in the `clean_up_params` method in the above
example.

Workarounds
-----------
Do not use the return values of `each`, `each_value`, or `each_pair` in your
application.
GitHub Security Advisory: GHSA-4fvg-pwv7-v54g
Package: karteek-docsplit (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: <= 0.5.4
Patched in: unpatched

Summary: Karteek Docsplit vulnerable to OS Command Injection

Details:
The `extract_from_ocr` function in `lib/docsplit/text_extractor.rb` in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename.
GitHub Security Advisory: GHSA-42gq-h7xj-33r4
Package: features (RUBYGEMS)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: <= 0.3.0
Patched in: unpatched

Summary: Features file injection vulnerability

Details:
File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the `/tmp` directory.
GitHub Security Advisory: GHSA-hh2x-7mf9-78fr
Package: sup (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 0.14.0, < 0.14.1.1
Patched in: 0.14.1.1

Summary: Sup Code Injection vulnerability

Details:
`lib/sup/message_chunks.rb` in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the content_type of an email attachment.
GitHub Security Advisory: GHSA-hh2x-7mf9-78fr
Package: sup (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 0.13.2.1
Patched in: 0.13.2.1

Summary: Sup Code Injection vulnerability

Details:
`lib/sup/message_chunks.rb` in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the content_type of an email attachment.
GitHub Security Advisory: GHSA-9qvm-2vhf-q649
Package: rubygems-update (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 2.1.0, < 2.1.5
Patched in: 2.1.5

Summary: RubyGems Regular Expression Denial of Service

Details:
Algorithmic complexity vulnerability in `Gem::Version::ANCHORED_VERSION_PATTERN` in `lib/rubygems/version.rb` in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.  NOTE: this issue is due to an incomplete fix for CVE-2013-4287.
GitHub Security Advisory: GHSA-9qvm-2vhf-q649
Package: rubygems-update (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 2.0.0, < 2.0.10
Patched in: 2.0.10

Summary: RubyGems Regular Expression Denial of Service

Details:
Algorithmic complexity vulnerability in `Gem::Version::ANCHORED_VERSION_PATTERN` in `lib/rubygems/version.rb` in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.  NOTE: this issue is due to an incomplete fix for CVE-2013-4287.
GitHub Security Advisory: GHSA-9qvm-2vhf-q649
Package: rubygems-update (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 1.8.24, < 1.8.27
Patched in: 1.8.27

Summary: RubyGems Regular Expression Denial of Service

Details:
Algorithmic complexity vulnerability in `Gem::Version::ANCHORED_VERSION_PATTERN` in `lib/rubygems/version.rb` in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.  NOTE: this issue is due to an incomplete fix for CVE-2013-4287.
GitHub Security Advisory: GHSA-9qvm-2vhf-q649
Package: rubygems-update (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 1.8.23.2
Patched in: 1.8.23.2

Summary: RubyGems Regular Expression Denial of Service

Details:
Algorithmic complexity vulnerability in `Gem::Version::ANCHORED_VERSION_PATTERN` in `lib/rubygems/version.rb` in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.  NOTE: this issue is due to an incomplete fix for CVE-2013-4287.
GitHub Security Advisory: GHSA-39v7-xpq4-8884
Package: pdfkit (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 0.5.3
Patched in: 0.5.3

Summary: PDFKit Improper Input Validation vulnerability

Details:
Ruby PDFKit gem prior to 0.5.3 has a Code Execution Vulnerability
GitHub Security Advisory: GHSA-9x97-x2p9-hvpf
Package: fileutils (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: < 0.7.1
Patched in: 0.7.1

Summary: Fileutils Command Injection vulnerability

Details:
Ruby Gem Fileutils prior to v0.7.1 contains a Command Injection vulnerability in user supplied url variable that is passed to the shell.
GitHub Security Advisory: GHSA-g897-cgfc-7q8v
Package: fat_free_crm (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-330: Use of Insufficiently Random Values
Vulnerable versions: < 0.12.1
Patched in: 0.12.1

Summary: Fat Free CRM has fixed token value

Details:
`config/initializers/secret_token.rb` in Fat Free CRM before 0.12.1 has a fixed `FatFreeCRM::Application.config.secret_token` value, which makes it easier for remote attackers to spoof signed cookies by referring to the key in the source code.
GitHub Security Advisory: GHSA-9j7m-rjqx-48vh
Package: rubygems-update (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 2.1.0.rc.1, < 2.1.0
Patched in: 2.1.0

Summary: RubyGems Regular Expression Denial of Service vulnerability

Details:
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in `lib/rubygems/version.rb` in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.
GitHub Security Advisory: GHSA-9j7m-rjqx-48vh
Package: rubygems-update (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 2.0.0, < 2.0.8
Patched in: 2.0.8

Summary: RubyGems Regular Expression Denial of Service vulnerability

Details:
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in `lib/rubygems/version.rb` in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.
GitHub Security Advisory: GHSA-9j7m-rjqx-48vh
Package: rubygems-update (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 1.8.24, < 1.8.26
Patched in: 1.8.26

Summary: RubyGems Regular Expression Denial of Service vulnerability

Details:
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in `lib/rubygems/version.rb` in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.
GitHub Security Advisory: GHSA-9j7m-rjqx-48vh
Package: rubygems-update (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.8.23.1
Patched in: 1.8.23.1

Summary: RubyGems Regular Expression Denial of Service vulnerability

Details:
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in `lib/rubygems/version.rb` in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.
GitHub Security Advisory: GHSA-8mvw-22r7-w6fq
Package: ruby_parser (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-377: Insecure Temporary File
Vulnerable versions: >= 2.0.2, < 3.1.2
Patched in: 3.1.2

Summary: ruby_parser allows local users to overwrite arbitrary files via symlink attack on temporary file with predictable name

Details:
The `diff_pp` function in `lib/gauntlet_rubyparser.rb` in the ruby_parser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in `/tmp`.
GitHub Security Advisory: GHSA-vq74-9583-hrm4
Package: publify_core (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 8.0.1
Patched in: 8.0.1

Summary: Publify vulnerable to DoS attack

Details:
Publify before 8.0.1 is vulnerable to a Denial of Service attack
GitHub Security Advisory: GHSA-wrxf-x8rm-6ggg
Package: fluentd-ui (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-276: Incorrect Default Permissions
Vulnerable versions: <= 1.2.2
Patched in: unpatched

Summary: Fluent Fluentd and Fluent-ui use default password

Details:
An issue was discovered in Fluent-ui v.1.2.2 allows attackers to gain escalated privileges and execute arbitrary code due to a default password.
GitHub Security Advisory: GHSA-6jwc-qr2q-7xwj
Package: protocol-http1 (RUBYGEMS)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: < 0.15.1
Patched in: 0.15.1

Summary: protocol-http1 HTTP Request/Response Smuggling vulnerability

Details:
### Impact

[RFC 9112 Section 7.1](https://www.rfc-editor.org/rfc/rfc9112#name-chunked-transfer-coding) defined the format of chunk size, chunk data and chunk extension (detailed ABNF is in Appendix section).

In summary:

- The value of Content-Length header should be a string of 0-9 digits.
- The chunk size should be a string of hex digits and should split from chunk data using CRLF.
- The chunk extension shouldn't contain any invisible character.

However, we found that Falcon has following behaviors while disobey the corresponding RFCs.

- Falcon accepts Content-Length header values that have "+" prefix.
- Falcon accepts Content-Length header values that written in hexadecimal with "0x" prefix.
- Falcon accepts "0x" and "+" prefixed chunk size.
- Falcon accepts LF in chunk extension.

This behavior can lead to desync when forwarding through multiple HTTP parsers, potentially results in HTTP request smuggling and firewall bypassing. Note that while these issues were reproduced in Falcon (the server), the issue is with `protocol-http1` which implements the HTTP/1 protocol parser. We have not yet been advised of any real world exploit or practical attack.

### Patches

Fixed in `protocol-http1` v0.15.1+.

### Workarounds

None.

### References

https://github.com/socketry/protocol-http1/pull/20
GitHub Security Advisory: GHSA-7mj4-2984-955f
Package: alchemy_cms (RUBYGEMS)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 4.1.0
Patched in: unpatched

Summary: Withdrawn Advisory: AlchemyCMS is vulnerable to stored XSS via the /admin/pictures image field

Details:
## Withdrawn Advisory

This advisory has been withdrawn because it does not describe a vulnerability. The maintainer states the following:

> The researcher used an authorized cookie to perform the request to a password-protected route. Without that session cookie, the request would have been rejected as unauthorized.

## Original Description

A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field.
GitHub Security Advisory: GHSA-369m-2gv6-mw28
Package: webrick (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-287: Improper Authentication
Vulnerable versions: < 1.4.0
Patched in: 1.4.0

Summary: WEBrick RCE Vulnerability

Details:
The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.
GitHub Security Advisory: GHSA-5652-92r9-3fx9
Package: decidim-core (RUBYGEMS)
Severity: HIGH (CVSS 8.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 0.14.0, < 0.26.7
Patched in: 0.26.7

Summary: Decidim Cross-site Scripting vulnerability in the processes filter

Details:
### Impact

The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing.

### Patches

The problem was patched in [v0.27.3](https://github.com/decidim/decidim/releases/tag/v0.27.3) and [v0.26.7](https://github.com/decidim/decidim/releases/tag/v0.26.7)
GitHub Security Advisory: GHSA-5652-92r9-3fx9
Package: decidim (RUBYGEMS)
Severity: HIGH (CVSS 8.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 0.14.0, < 0.26.7
Patched in: 0.26.7

Summary: Decidim Cross-site Scripting vulnerability in the processes filter

Details:
### Impact

The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing.

### Patches

The problem was patched in [v0.27.3](https://github.com/decidim/decidim/releases/tag/v0.27.3) and [v0.26.7](https://github.com/decidim/decidim/releases/tag/v0.26.7)