GHSA-9MVP-W4RR-5C6X
Vulnerability from github – Published: 2026-09-09 17:59 – Updated: 2026-09-09 17:59Description
A low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely.
Technical description
This stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores question.body as a normal translatable string, and the public helper question_title returns that value with html_safe and no sanitization boundary, so any user who can edit election questions can persist markup or script-bearing payloads that later render on public election pages.
Impact
A low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens.
Patches
See https://github.com/decidim/decidim/pull/16659
Workarounds
Developers should review their implementation's administrator accesses and not give access to untrustworthy users
Resources
OWASP XSS Injection
Credits
This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "decidim-elections"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.32.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44282"
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-09T17:59:52Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Description\n\nA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely.\n\n## Technical description\n \nThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores `question.body` as a normal translatable string, and the public helper `question_title` returns that value with `html_safe` and no sanitization boundary, so any user who can edit election questions can persist markup or script-bearing payloads that later render on public election pages.\n\n\u003cimg width=\"1506\" height=\"1285\" alt=\"decidim-election-01\" src=\"https://github.com/user-attachments/assets/2e17f396-10f9-4423-bb97-5badbdb20d21\" /\u003e\n\u003cimg width=\"1540\" height=\"657\" alt=\"decidim-election-02\" src=\"https://github.com/user-attachments/assets/178adb7b-d00e-4b5d-9237-f391e523973f\" /\u003e\n\n### Impact\n\nA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor\u0027s browsers on public election pages and voting booth screens.\n\n### Patches\n\nSee https://github.com/decidim/decidim/pull/16659\n\n### Workarounds\n\nDevelopers should review their implementation\u0027s administrator accesses and not give access to untrustworthy users\n\n### Resources\n\nOWASP XSS Injection\n\n### Credits\n\nThis issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).",
"id": "GHSA-9mvp-w4rr-5c6x",
"modified": "2026-09-09T17:59:52Z",
"published": "2026-09-09T17:59:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/decidim/decidim/security/advisories/GHSA-9mvp-w4rr-5c6x"
},
{
"type": "WEB",
"url": "https://github.com/decidim/decidim/pull/16659"
},
{
"type": "PACKAGE",
"url": "https://github.com/decidim/decidim"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "decidim-elections: Election question titles allow stored script execution"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.