medium

CVE-2026-44282

RubyGems · decidim-elections

Summary

decidim-elections: Election question titles allow stored script execution

Severity
medium
CVSS
4.8
CWE
CWE-79
Also known as
GHSA-9mvp-w4rr-5c6x
Published
2026-09-09
Updated
2026-09-09

Advisory details

Description

A low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely.

Technical description

This stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores question.body as a normal translatable string, and the public helper question_title returns that value with html_safe and no sanitization boundary, so any user who can edit election questions can persist markup or script-bearing payloads that later render on public election pages.

decidim-election-01 decidim-election-02

Impact

A low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens.

Patches

See https://github.com/decidim/decidim/pull/16659

Workarounds

Developers should review their implementation's administrator accesses and not give access to untrustworthy users

Resources

OWASP XSS Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

References

Related advisories

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPTClaudePerplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.