CVE-2026-23891

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-23891
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23891.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-23891
Aliases
Published
2026-04-13T16:52:16Z
Modified
2026-10-28T02:31:13Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L CVSS Calculator
Summary
Decidim has a Cross-site scripting (XSS) vulnerability via user name field
Details

Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries. This issue has been fixed in versions 0.30.5 and 0.31.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23891.json"
}
References

Affected packages

Git / github.com/decidim/decidim

Affected ranges

Type
GIT
Repo
https://github.com/decidim/decidim
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ed4d23c283cb03d3423493aeb5a7860bc8f5bfa3
Introduced
0795da14454a4fb342d70654bdc267d1d6d5bca5
Fixed
0a9443ed804ee6274fab904878bc0103af1c0f69
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.30.5"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:decidim:decidim:*:*:*:*:*:ruby:*:*",
            "range":  [
                {
                    "introduced":  "0.31.0"
                },
                {
                    "fixed":  "0.31.1"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "original_tag":  "v0.30.5",
            "range":  [
                {
                    "fixed":  "ed4d23c283cb03d3423493aeb5a7860bc8f5bfa3"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v0.31.1",
            "range":  [
                {
                    "fixed":  "0a9443ed804ee6274fab904878bc0103af1c0f69"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*
v0.0.1
v0.0.1.alpha
v0.0.1.alpha1
v0.0.1.alpha2
v0.0.1.alpha3
v0.0.1.alpha4
v0.0.1.alpha5
v0.0.1.alpha6
v0.0.1.alpha7
v0.0.1.alpha8
v0.0.1.alpha9
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v0.0.8.1
v0.1.0
v0.2.0
v0.20.0
v0.3.0
v0.30.0
v0.30.0.rc1
v0.30.0.rc2
v0.30.0.rc3
v0.30.1
v0.30.2
v0.30.3
v0.30.4
v0.31.0
v0.4.0
v0.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23891.json"