Decidim Stored Code Execution Vulnerability in User Name Field

A stored code execution vulnerability has been identified in the Decidim participatory democracy framework, specifically in versions prior to 0.30.5 and 0.31.0.rc1 through 0.31.0. This vulnerability allows a low-privileged attacker to execute arbitrary code in the context of any user who visits a comment page, leading to significant impacts on confidentiality and integrity across security boundaries.

Impact

Exploitation of this vulnerability allows for stored code execution, where injected code is executed in the context of users who view the affected comment page.

Remediation

Users can upgrade to Decidim versions 0.30.5 or 0.31.1 to address this vulnerability.