https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-03T07:27:45.119563+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-44282 fkie_cve-2026-44282 2026-10-03T07:27:45.121361+00:00

Decidim is a participatory democracy framework. Prior to 0.32.0, a low-privilege process-scoped administrator or election editor with question-management rights can store HTML or script-bearing content in question.body. The question_title helper returns the translatable question body through html_safe without a sanitization boundary, causing stored script execution when visitors open public election pages or voting booth screens. The persisted script executes in visitors' browsers. The vulnerability is fixed in 0.32.0.

 https://db.gcve.eu/vuln/ghsa-9mvp-w4rr-5c6x GHSA-9mvp-w4rr-5c6x — decidim-elections: Election question titles allow stored script execution 2026-10-03T07:27:45.121478+00:00

Affected: RubyGems: decidim-elections

## Description

A low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely.

## Technical description This stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores `question.body` as a normal translatable string, and the public helper `question_title` returns that value with `html_safe` and no sanitization boundary, so any user who can edit election questions can persist markup or script-bearing payloads that later render on public election pages.

<img width="1506" height="1285" alt="decidim-election-01" src="https://github.com/user-attachments/assets/2e17f396-10f9-4423-bb97-5badbdb20d21" /> <img width="1540" height="657" alt="decidim-election-02" src="https://github.com/user-attachments/assets/178adb7b-d00e-4b5d-9237-f391e523973f" />

### Impact

A low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens.

### Patches

See https://github.com/decidim/decidim/pull/16659

### Workarounds

Developers should review their implementation's administrator accesses and not give access to untrustworthy users

### Resources

OWASP XSS Injection

### Credits

This issue was discovered in a security audit organized by the […