CVE-2026-23891: Decidim stored XSS in user name field

Executive brief

A stored cross-site scripting (XSS) vulnerability in Decidim allows low-privileged attackers to execute arbitrary code in the context of other users by manipulating the user name field.

References

• https://api.github.com/users/cyberschnaps
• https://github.com/cyberschnaps
• https://api.github.com/users/cyberschnaps/gists%7B/gist_id%7D
• https://api.github.com/users/cyberschnaps/repos
• https://avatars.githubusercontent.com/u/7559821?v=4
• https://api.github.com/users/cyberschnaps/events%7B/privacy%7D