CVE-2026-23891: Decidim has a Cross-site scripting (XSS) vulnerability via user name field
Impact A stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries.
Patches N/A
Workarounds Not available
References OWASP ASVS v4.0.3-5.1.3
Credits This issue was discovered in a security audit organized by octree and made by Secu Labs against Decidim financed by the city of Lausanne (Switzerland).
Other sources
Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries. This issue has been fixed in versions 0.30.5 and 0.31.1.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23891?
CVE-2026-23891 has a high severity level due to the potential for arbitrary code execution.
How do I fix CVE-2026-23891?
To fix CVE-2026-23891, upgrade to decidim-core version 0.30.5 or 0.31.1.
Which versions of Decidim are affected by CVE-2026-23891?
CVE-2026-23891 affects all versions of decidim-core prior to 0.30.5 and between 0.31.0.rc1 and 0.31.0.
What type of vulnerability is CVE-2026-23891?
CVE-2026-23891 is a Cross-site scripting (XSS) vulnerability that allows code execution via the user name field.
Who can exploit CVE-2026-23891?
A low-privileged attacker can exploit CVE-2026-23891 to execute arbitrary code on the client side.