{"id":"CVE-2026-44282","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-44282","summary":"decidim-elections: Election question titles allow stored script execution","details":"## Description\n\nA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely.\n\n## Technical description\n \nThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores `question.body` as a normal translatable string, and the public helper `question_title` returns that value with `html_safe` and no sanitization boundary, so any user who can edit election questions can persist markup or script-bearing payloads that later render on public election pages.\n\n<img width=\"1506\" height=\"1285\" alt=\"decidim-election-01\" src=\"https://github.com/user-attachments/assets/2e17f396-10f9-4423-bb97-5badbdb20d21\" />\n<img width=\"1540\" height=\"657\" alt=\"decidim-election-02\" src=\"https://github.com/user-attachments/assets/178adb7b-d00e-4b5d-9237-f391e523973f\" />\n\n### Impact\n\nA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens.\n\n### Patches\n\nSee https://github.com/decidim/decidim/pull/16659\n\n### Workarounds\n\nDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users\n\n### Resources\n\nOWASP XSS Injection\n\n### Credits\n\nThis issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).","published":"2026-09-09T17:59:52Z","modified":"2026-09-09T18:26:04.522562Z","cvss":{"score":4.8,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"RubyGems","name":"decidim-elections","fixedVersion":"0.32.0"}],"fix":{"url":"https://github.com/decidim/decidim/pull/16659","label":"decidim/decidim#16659"},"references":[{"type":"WEB","url":"https://github.com/decidim/decidim/security/advisories/GHSA-9mvp-w4rr-5c6x"},{"type":"WEB","url":"https://github.com/decidim/decidim/pull/16659"},{"type":"PACKAGE","url":"https://github.com/decidim/decidim"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-09T18:26:04.522562Z"}}