Loomio 3.3.1 is a security release that prevents stored cross-site scripting in revision history, removes User API credentials from group exports, and invalidates API keys that may have appeared in earlier exports. It also fixes discussion tags being removed during unrelated edits.
- Fix: Escape discussion and poll titles when displaying revision history
- Fix: Exclude User API keys from group exports and rotate every existing key
- Fix: Preserve discussion tags when editing a discussion or a poll in its thread
Stored XSS in revision history
Discussion and poll titles were treated as HTML when Loomio displayed their revision history. A group member who could edit a title could store executable markup that ran when another user opened the history.
Titles are now escaped as plain text before entering the HTML diff renderer. This protects existing stored revisions as well as new edits while preserving rich-text diffs for descriptions and other body fields.
See GHSA-8g3m-wppv-2mfq.
User API keys in group exports
Group data exports included each exported user's User API key. A group coordinator with access to an export could use a member's key to authenticate to the User API as that member, including in groups the coordinator did not administer.
Group exports now exclude User API keys. During the 3.3.1 database migration, Loomio replaces every existing User API key so that a key contained in an earlier export no longer works. Existing User API integrations must be updated with the replacement key from /profile/api_access. See the User API documentation for setup details. Passwords, browser sessions, email credentials, and other account settings are not changed.
See GHSA-8vf6-75f8-99p6.
Thread tags
Editing a discussion's context or editing a poll within a discussion could remove the discussion's tags even when the edit did not change them. Tags now remain in place until someone changes them through the thread's tag controls.
Upgrade
Make and verify a current database backup. Set LOOMIO_CONTAINER_TAG=3.3 in
.env, then run:
./update.shThe migration updates every row in the users table to assign a replacement API key. Existing User API integrations stop authenticating until their stored key is updated. The rotation is intentionally irreversible because the previous keys may have been exposed. This release does not otherwise change the database schema, and the rotated keys remain compatible with Loomio 3.3.0.