In short
- CVE-2026-23891 is a HIGH (CVSS 8.7) vulnerability affecting decidim-core, decidim (decidim).
- Chance of exploitation in the next 30 days (EPSS): 0.36%, higher than 29.4% of all vulnerabilities.
- Fix: update to 0.31.1, 0.30.5 or later.
| Package | Affected versions | Patched versions |
|---|
| decidim-core RubyGems | ≥ 0.31.0.rc1, < 0.31.1< 0.30.5
| 0.31.10.30.5
|
| decidim | ≥ 0.31.0, < 0.31.1< 0.30.5
| 0.31.10.30.5
|
Description
Impact
A stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries.
Patches
N/A
Workarounds
Not available
References
OWASP ASVS v4.0.3-5.1.3
Credits
This issue was discovered in a security audit organized by octree and made by Secu Labs against Decidim financed by the city of Lausanne (Switzerland).
NVD description
Decidim is a participatory democracy framework. In versions below 0.30.5 and 0.31.0.rc1 through 0.31.0, a stored code execution vulnerability in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page, resulting in high confidentiality and integrity impact across security boundaries. This issue has been fixed in versions 0.30.5 and 0.31.1.
More vulnerabilities in decidim-core
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free