EUVD-2026-22024

Decidim is an open-source participatory democracy platform built on Ruby on Rails. This vulnerability stems from insufficient input sanitization in the user name field (CWE-79: Improper Neutralization of Input During Web Page Generation). The affected component is the decidim-core RubyGem (pkg:rubygems/decidim-core), which provides core functionality for the Decidim platform. Unlike typical reflected XSS, this is a stored code execution vulnerability where malicious payloads persist in the database and execute whenever other users view pages containing the attacker's username, such as comment sections. The classification as both XSS and RCE in tags suggests the payload can achieve remote code execution in the browser context, potentially leveraging modern browser APIs or framework-specific features to escalate beyond traditional XSS limitations. The vulnerability was identified through a professional security audit conducted by Secu Labs for the city of Lausanne, indicating rigorous third-party validation. The OWASP ASVS v4.0.3-5.1.3 reference points to requirements for output encoding and injection prevention.