CVE-2026-23891CWE-79

Decidim has a Cross-site scripting (XSS) vulnerability via user name field

Critical · published April 13, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
28.1
In the wild
Unconfirmed
What it is

Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries. This issue has been fixed in versions 0.30.5 and 0.31.1.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
EPSS
0.00356 · 28.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-04-13T16:52Z
EPSS history
Timeline
  • 13 APR 16:52Z
    Decidim has a Cross-site scripting (XSS) vulnerability via user name field
    cvelistv5