CVE-2026-23891
HIGHDecidim <0.30.5 and <0.31.1 User Name - Stored Cross-Site Scripting
Title source: manualDescription
Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries. This issue has been fixed in versions 0.30.5 and 0.31.1.
References (3)
Core 3
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/decidim/decidim/security/advisories/GHSA-fc46-r95f-hq7g
X_Refsource_Misc x_refsource_misc
https://github.com/decidim/decidim/releases/tag/v0.30.5
X_Refsource_Misc x_refsource_misc
https://github.com/decidim/decidim/releases/tag/v0.31.1
Scores
CVSS v3
8.7
EPSS
0.0036
EPSS Percentile
27.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (4)
decidim/decidim
< 0.30.5 (2 CPE variants)
decidim/decidim
>= 0.31.0.rc1, < 0.31.1
rubygems/decidim-core
0 - 0.30.5RubyGems
rubygems/decidim-core
0.31.0.rc1 - 0.31.1RubyGems
Published
Apr 13, 2026
Tracked Since
Apr 13, 2026