https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 07:27:46 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-44282 <p>Decidim is a participatory democracy framework. Prior to 0.32.0, a low-privilege process-scoped administrator or election editor with question-management rights can store HTML or script-bearing content in question.body. The question_title helper returns the translatable question body through html_safe without a sanitization boundary, causing stored script execution when visitors open public election pages or voting booth screens. The persisted script executes in visitors&#39; browsers. The vulnerability is fixed in 0.32.0.</p> <p>Decidim is a participatory democracy framework. Prior to 0.32.0, a low-privilege process-scoped administrator or election editor with question-management rights can store HTML or script-bearing content in question.body. The question_title helper returns the translatable question body through html_safe without a sanitization boundary, causing stored script execution when visitors open public election pages or voting booth screens. The persisted script executes in visitors&#39; browsers. The vulnerability is fixed in 0.32.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-44282 https://db.gcve.eu/vuln/ghsa-9mvp-w4rr-5c6x <p><strong>Affected:</strong> RubyGems: decidim-elections</p> <p>## Description</p> <p>A low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely.</p> <p>## Technical description This stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores `question.body` as a normal translatable string, and the public helper `question_title` returns that value with `html_safe` and no sanitization boundary, so any user who can edit election questions can persist markup or script-bearing payloads that later render on public election pages.</p> <p>&lt;img width=&#34;1506&#34; height=&#34;1285&#34; alt=&#34;decidim-election-01&#34; src=&#34;https://github.com/user-attachments/assets/2e17f396-10f9-4423-bb97-5badbdb20d21&#34; /&gt; &lt;img width=&#34;1540&#34; height=&#34;657&#34; alt=&#34;decidim-election-02&#34; src=&#34;https://github.com/user-attachments/assets/178adb7b-d00e-4b5d-9237-f391e523973f&#34; /&gt;</p> <p>### Impact</p> <p>A low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor&#39;s browsers on public election pages and voting booth screens.</p> <p>### Patches</p> <p>See https://github.com/decidim/decidim/pull/16659</p> <p>### Workarounds</p> <p>Developers should review their implementation&#39;s administrator accesses and not give access to untrustworthy users</p> <p>### Resources</p> <p>OWASP XSS Injection</p> <p>### Credits</p> <p>This issue was discovered in a security audit organized by the […</p> <p><strong>Affected:</strong> RubyGems: decidim-elections</p> <p>## Description</p> <p>A low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely.</p> <p>## Technical description This stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores `question.body` as a normal translatable string, and the public helper `question_title` returns that value with `html_safe` and no sanitization boundary, so any user who can edit election questions can persist markup or script-bearing payloads that later render on public election pages.</p> <p>&lt;img width=&#34;1506&#34; height=&#34;1285&#34; alt=&#34;decidim-election-01&#34; src=&#34;https://github.com/user-attachments/assets/2e17f396-10f9-4423-bb97-5badbdb20d21&#34; /&gt; &lt;img width=&#34;1540&#34; height=&#34;657&#34; alt=&#34;decidim-election-02&#34; src=&#34;https://github.com/user-attachments/assets/178adb7b-d00e-4b5d-9237-f391e523973f&#34; /&gt;</p> <p>### Impact</p> <p>A low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor&#39;s browsers on public election pages and voting booth screens.</p> <p>### Patches</p> <p>See https://github.com/decidim/decidim/pull/16659</p> <p>### Workarounds</p> <p>Developers should review their implementation&#39;s administrator accesses and not give access to untrustworthy users</p> <p>### Resources</p> <p>OWASP XSS Injection</p> <p>### Credits</p> <p>This issue was discovered in a security audit organized by the […</p> https://db.gcve.eu/vuln/ghsa-9mvp-w4rr-5c6x