GHSA-9mvp-w4rr-5c6x decidim-elections: Election question titles allow stored script execution

• RubyGems decidim-elections: < 0.32.0 → fixed in 0.32.0

Description A low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical description This stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores `question.body` as a normal translatable string, and the public helper `question_title` returns that value with `html_safe` and no sanitization boundary, so any user who can edit election questions can persist markup or script-bearing payloads that later render on public election pages. Impact A low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. Patches See https://github.com/decidim/decidim/pull/16659 Workarounds Developers should review their implementation's administrator accesses and not give access to untrustworthy users Resources OWASP XSS Injection Credits This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.