This vulnerability allows a stored cross‑site scripting flaw through the user name field, enabling a low‑privileged attacker to inject code that is executed in the browser context of any visitor to a comment page. The exploited code runs with the privileges of the visiting user, providing high confidentiality and integrity impact across security boundaries.

Decidim users running the open‑source participatory democracy framework are affected. Versions lower than 0.30.5, and releases 0.31.0.rc1 to 0.31.0, are vulnerable. All other versions, including 0.30.5 and 0.31.1, contain the fix.

The flaw has a high CVSS score of 9.3 and is listed as a stored XSS that facilitates arbitrary code execution. The EPSS score is not available, and the vulnerability is not catalogued in CISA KEV. The attack can be performed by any user who can create or modify a comment with a maliciously crafted name; the victim simply needs to open the comment page, making exploitation highly feasible for an attacker with minimal resources.