by Kastro
Paper/Archive/CVE-2026-23891

CVE-2026-23891

decidim decidim — Decidim has a Cross-site scripting (XSS) vulnerability via user name field

EPSS 0.4%CVSS 9.3
critical.is priorityof 100
34
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 29.4.294 × 205.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries. This issue has been fixed in versions 0.30.5 and 0.31.1.

Affected

ProductAffectedFixed inSource
decidim>= 0.31.0.rc1, < 0.31.1–CNA
decidim< 0.30.5–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/decidim/decidim/security/advisories/GHSA-fc46-r95f-hq7grefgithub.com/decidim/decidim/releases/tag/v0.30.5refgithub.com/decidim/decidim/releases/tag/v0.31.1