{"id":"CVE-2026-44282","aliases":["GHSA-9mvp-w4rr-5c6x"],"url":"https://o3.security/vulnerability/CVE-2026-44282","summary":"Election question titles allow stored script execution","details":"## Description\n\nA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely.\n\n## Technical description\n \nThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores `question.body` as a normal translatable string, and the public helper `question_title` returns that value with `html_safe` and no sanitization boundary, so any user who can edit election questions can persist markup or script-bearing payloads that later render on public election pages.\n\n<img width=\"1506\" height=\"1285\" alt=\"decidim-election-01\" src=\"https://github.com/user-attachments/assets/2e17f396-10f9-4423-bb97-5badbdb20d21\" />\n<img width=\"1540\" height=\"657\" alt=\"decidim-election-02\" src=\"https://github.com/user-attachments/assets/178adb7b-d00e-4b5d-9237-f391e523973f\" />\n\n### Impact\n\nA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens.\n\n### Patches\n\nSee https://github.com/decidim/decidim/pull/16659\n\n### Workarounds\n\nDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users\n\n### Resources\n\nOWASP XSS Injection\n\n### Credits\n\nThis issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).","published":"2026-09-15T15:25:56.036Z","modified":"2026-10-21T02:57:57.809205110Z","cvss":{"score":4.8,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"RubyGems","name":"decidim-elections","fixedVersion":"0.32.0"}],"fix":{"url":"https://github.com/decidim/decidim/commit/64dbea3739f360f1eb36932dfc49d9686e61fc00","label":"decidim/decidim@64dbea3"},"references":[{"type":"WEB","url":"https://github.com/decidim/decidim/releases/tag/v0.32.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44282.json"},{"type":"ADVISORY","url":"https://github.com/decidim/decidim/security/advisories/GHSA-9mvp-w4rr-5c6x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44282"},{"type":"FIX","url":"https://github.com/decidim/decidim/commit/64dbea3739f360f1eb36932dfc49d9686e61fc00"},{"type":"FIX","url":"https://github.com/decidim/decidim/commit/b6e1b003365d10c0df2bc7edc5edd26b62fafda1"},{"type":"FIX","url":"https://github.com/decidim/decidim/pull/16659"},{"type":"FIX","url":"https://github.com/decidim/decidim/pull/16669"},{"type":"PACKAGE","url":"https://github.com/decidim/decidim"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:57:57.809205110Z"}}