CVEvulnerability
CVE-2026-44282
4.8 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2026-09-15
- Last modified
- 2026-09-30
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.8 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
Description
Decidim is a participatory democracy framework. Prior to 0.32.0, a low-privilege process-scoped administrator or election editor with question-management rights can store HTML or script-bearing content in question.body. The question_title helper returns the translatable question body through html_safe without a sanitization boundary, causing stored script execution when visitors open public election pages or voting booth screens. The persisted script executes in visitors' browsers. The vulnerability is fixed in 0.32.0.
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/decidim/decidim/commit/64dbea3739f360f1eb36932dfc49d9686e61fc00 github.com
- https://github.com/decidim/decidim/commit/b6e1b003365d10c0df2bc7edc5edd26b62fafda1 github.com
- https://github.com/decidim/decidim/pull/16659 github.com
- https://github.com/decidim/decidim/pull/16669 github.com
- https://github.com/decidim/decidim/releases/tag/v0.32.0 github.com
- https://github.com/decidim/decidim/security/advisories/GHSA-9mvp-w4rr-5c6x github.com