PT-2026-32446 · Decidim · Decidim

Published 2026-04-13 · Updated 2026-04-28 · CVE-2026-23891

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.30.5 Decidim versions 0.31.0.rc1 through 0.31.0

Description A stored code execution issue in the user name field allows a low-privileged attacker to execute arbitrary code in the context of any user who passively visits a comment page. This results in high confidentiality and integrity impact across security boundaries.

Recommendations Update to version 0.30.5 for versions prior to 0.30.5. Update to version 0.31.1 for versions 0.31.0.rc1 through 0.31.0.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-23891

GHSA-FC46-R95F-HQ7G

Affected Products

Decidim

References · 10

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim-core/CVE-2026-23891.yml · Exploit
• https://github.com/decidim/decidim/security/advisories/GHSA-fc46-r95f-hq7g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23891 · Security Note
• https://osv.dev/vulnerability/GHSA-fc46-r95f-hq7g · Vendor Advisory
• https://github.com/decidim/decidim/releases/tag/v0.31.1 · Note
• https://github.com/decidim/decidim · Note
• https://github.com/decidim/decidim/releases/tag/v0.30.5 · Note
• https://twitter.com/_cvereports/status/2049068788625051825 · Twitter Post
• https://twitter.com/pulsepatchio/status/2044248394990805346 · Twitter Post
• https://twitter.com/0dayPublishing/status/2043738411614277714 · Twitter Post