GHSA-fc46-r95f-hq7g

Suggest an improvement
Source
https://github.com/advisories/GHSA-fc46-r95f-hq7g
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-fc46-r95f-hq7g/GHSA-fc46-r95f-hq7g.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-fc46-r95f-hq7g
Aliases
Published
2026-04-13T16:35:13Z
Modified
2026-05-13T16:38:42Z
Severity
  • 8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L CVSS Calculator
Summary
Decidim has a cross-site scripting (XSS) in user name
Details

Impact

A stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries.

Patches

N/A

Workarounds

Not available

References

OWASP ASVS v4.0.3-5.1.3

Credits

This issue was discovered in a security audit organized by octree and made by Secu Labs against Decidim financed by the city of Lausanne (Switzerland).

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-13T16:35:13Z",
    "nvd_published_at":  "2026-04-13T17:16:28Z",
    "severity":  "CRITICAL"
}
References

Affected packages

RubyGems / decidim-core

Package

Name
decidim-core
Purl
pkg:gem/decidim-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.31.0.rc1
Fixed
0.31.1

Affected versions

0.*
0.31.0.rc1
0.31.0.rc2
0.31.0

Database specific

last_known_affected_version_range 
"< 0.31.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-fc46-r95f-hq7g/GHSA-fc46-r95f-hq7g.json"

RubyGems / decidim-core

Package

Name
decidim-core
Purl
pkg:gem/decidim-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.30.5

Affected versions

0.*
0.0.1.alpha1
0.0.1.alpha2
0.0.1.alpha3
0.0.1.alpha4
0.0.1.alpha5
0.0.1.alpha6
0.0.1.alpha7
0.0.1.alpha8
0.0.1.alpha9
0.0.1
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
0.0.8.1
0.1.0
0.2.0
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.9.0
0.9.1
0.9.2
0.9.3
0.10.0
0.10.1
0.11.0.pre1
0.11.1
0.11.2
0.12.0.pre
0.12.0
0.12.1
0.12.2
0.13.0.pre1
0.13.0
0.13.1
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.1
0.15.2
0.16.0
0.16.1
0.17.0
0.17.1
0.17.2
0.18.0
0.18.1
0.19.0
0.19.1
0.20.0
0.20.1
0.21.0
0.22.0
0.23.0
0.23.1.rc1
0.23.1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0.rc1
0.24.0.rc2
0.24.0
0.24.1
0.24.2
0.24.3
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.0
0.25.1
0.25.2
0.26.0.rc1
0.26.0.rc2
0.26.0
0.26.1
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.26.10
0.27.0.rc1
0.27.0.rc2
0.27.0
0.27.1
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.27.10
0.28.0.rc4
0.28.0.rc5
0.28.0
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.29.0.rc1
0.29.0.rc2
0.29.0.rc3
0.29.0.rc4
0.29.0
0.29.1
0.29.2
0.29.3
0.29.4
0.29.5
0.29.6
0.29.7
0.30.0.rc1
0.30.0.rc2
0.30.0.rc3
0.30.0
0.30.1
0.30.2
0.30.3
0.30.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-fc46-r95f-hq7g/GHSA-fc46-r95f-hq7g.json"