VYPR
← All advisories
Medium severity6.5OSV Advisory· Published Feb 3, 2026· Updated Jun 17, 2026

CVE-2025-65017

CVE-2025-65017

Description

Decidim is a participatory democracy framework. In versions from 0.30.0 to before 0.30.4 and from 0.31.0.rc1 to before 0.31.0, the private data exports can lead to data leaks in case the UUID generation, causing collisions for the generated UUIDs. This issue has been patched in versions 0.30.4 and 0.31.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
decidim-coreRubyGems
>= 0.30.0, < 0.30.40.30.4
decidimRubyGems
>= 0.30.0, < 0.30.40.30.4

Affected products

6
  • Decidim/DecidimOSV4 versions
    v0.0.1, v0.0.1.alpha, v0.0.1.alpha1, …+ 3 more
    • (no CPE)range: v0.0.1, v0.0.1.alpha, v0.0.1.alpha1, …
    • cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:*range: >=0.30.0,<0.30.4
    • cpe:2.3:a:decidim:decidim:0.31.0:rc1:*:*:*:ruby:*:*
    • cpe:2.3:a:decidim:decidim:0.31.0:rc2:*:*:*:ruby:*:*
  • ghsa-coords2 versions
    pkg:gem/decidimpkg:gem/decidim-core
    >= 0.30.0, < 0.30.4+ 1 more
    • (no CPE)range: >= 0.30.0, < 0.30.4
    • (no CPE)range: >= 0.30.0, < 0.30.4

Patches

Vulnerability mechanics

References

8

News mentions

0

No linked articles in our index yet.