XSS in Decidim
CVE-2026-23891
Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context…
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.001 (16.8th percentile) — read the EPSS interpretation.
Affected products
- Decidim — versions >= 0.31.0.rc1, < 0.31.1, < 0.30.5
Weakness classification (CWE)
References
- https://github.com/decidim/decidim/security/advisories/GHSA-fc46-r95f-hq7g (x_refsource_CONFIRM)
- https://github.com/decidim/decidim/releases/tag/v0.30.5 (x_refsource_MISC)
- https://github.com/decidim/decidim/releases/tag/v0.31.1 (x_refsource_MISC)