{"id":"CVE-2026-45572","aliases":["GHSA-533c-2vh9-4r86"],"url":"https://o3.security/vulnerability/CVE-2026-45572","summary":"Decidim: HTML content blocks allow stored script execution","details":"## Description\n \nA privileged admin user who can edit an affected landing page can store arbitrary HTML/JavaScript in an `HTML block`, and the public page renders it with `html_safe` and no output escaping.\n\n## Technical description\n    \nThis issue lets any admin who can edit an affected landing page store arbitrary HTML and JavaScript in an `HTML block`. The block is then rendered back through `Decidim::ContentBlocks::HtmlCell#html_content` without a sanitization boundary, so the script executes later in visitor's browsers.\n\n<img width=\"1541\" height=\"439\" alt=\"decidim-html-xss-01\" src=\"https://github.com/user-attachments/assets/acae1c06-8acb-49be-ab12-aabae33190ce\" />\n\n<img width=\"1540\" height=\"752\" alt=\"decidim-html-xss-02\" src=\"https://github.com/user-attachments/assets/a2f1fa7f-03f3-4d17-b58b-f4db865443e9\" />\n\n\n### Impact\n\n- A user with landing-page editing rights for an affected scope can persist JavaScript that executes in visitor's browsers on that page.\n- Because exploitation already requires privileged administrative access, the practical risk is lower than a participant-controlled or unauthenticated stored XSS. It still creates a browser-execution primitive in a trusted admin-editable surface.\n\n### Patches\n\nSee https://github.com/decidim/decidim/pull/16451 \n\n### Workarounds\n\nDo not give admin permissions to non-trustful users. \n\n### Reference\n\nStored XSS\n\n### Credits\n\nThis issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).","published":"2026-08-06T20:10:54.774Z","modified":"2026-09-10T03:30:26.159046678Z","cvss":{"score":4.8,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},"epss":{"score":0.0018,"percentile":0.0782,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"decidim-core","fixedVersion":"0.30.9"},{"ecosystem":"RubyGems","name":"decidim-core","fixedVersion":"0.31.5"},{"ecosystem":"RubyGems","name":"decidim-core","fixedVersion":"0.32.0"}],"fix":{"url":"https://github.com/decidim/decidim/pull/16451","label":"decidim/decidim#16451"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45572.json"},{"type":"ADVISORY","url":"https://github.com/decidim/decidim/security/advisories/GHSA-533c-2vh9-4r86"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45572"},{"type":"FIX","url":"https://github.com/decidim/decidim/pull/16451"},{"type":"PACKAGE","url":"https://github.com/decidim/decidim"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:30:26.159046678Z"}}