What is the CVSS score of CVE-2026-45572?

CVE-2026-45572 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-45572?

Yes, a patch is available for CVE-2026-45572. Update the affected software to the latest version immediately.

Decidim CVE-2026-45572

EUVD-2026-54251 MEDIUM

Code Injection (CWE-94)

2026-07-13 https://github.com/decidim/decidim

GHSA-533c-2vh9-4r86

XSS RCE Code Injection

4.8

CVSS 3.1 · Vendor: https://github.com/decidim/decidim

Severity by source

Vendor (https://github.com/decidim/decidim) PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

4.8 MEDIUM

PR:H reflects mandatory admin-level landing-page editing rights; S:C applies because the injected script executes in visitor browser contexts outside the server trust boundary.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (https://github.com/decidim/decidim).

CVSS VectorVendor: https://github.com/decidim/decidim

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 13, 2026 - 19:41 vuln.today

Analysis Generated

Jul 13, 2026 - 19:41 vuln.today

DescriptionCVE.org

Description

A privileged admin user who can edit an affected landing page can store arbitrary HTML/JavaScript in an HTML block, and the public page renders it with html_safe and no output escaping.

Technical description

This issue lets any admin who can edit an affected landing page store arbitrary HTML and JavaScript in an HTML block. The block is then rendered back through Decidim::ContentBlocks::HtmlCell#html_content without a sanitization boundary, so the script executes later in visitor's browsers.

Impact

A user with landing-page editing rights for an affected scope can persist JavaScript that executes in visitor's browsers on that page.
Because exploitation already requires privileged administrative access, the practical risk is lower than a participant-controlled or unauthenticated stored XSS. It still creates a browser-execution primitive in a trusted admin-editable surface.

Patches

See https://github.com/decidim/decidim/pull/16451

Workarounds

Do not give admin permissions to non-trustful users.

Reference

Stored XSS

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

AnalysisAI

Stored XSS in Decidim's HTML content blocks allows any administrator with landing-page editing rights to persist arbitrary JavaScript that executes in every visitor's browser. The vulnerability affects the decidim-core RubyGem across three release branches (below 0.30.9, 0.31.5, and 0.32.0) and was confirmed through a professional security audit by Radically Open Security. No public exploit code or CISA KEV listing exists; vendor-released patches are available and the fix has been merged upstream.

Technical ContextAI

Decidim is a Ruby on Rails participatory-democracy platform distributed as the decidim-core RubyGem (pkg:rubygems/decidim-core). The flaw resides in multiple content-block cell classes - primarily Decidim::ContentBlocks::HtmlCell but also StaticPage::SectionCell, SummaryCell, and TwoPaneSectionCell - which call .html_safe on admin-supplied HTML retrieved via translated_attribute(model.settings.html_content), bypassing Rails' default output escaping entirely and delivering raw markup to the view renderer. The root cause is classified as CWE-94 (Code Injection) because attacker-controlled content is executed as code rather than treated as data; the practical manifestation is a stored (persistent) cross-site scripting sink. The PR #16451 fix replaces every unsafe .html_safe call with decidim_sanitize_editor_admin(), applying an allowlist-based HTML sanitizer appropriate for admin-authored rich text, across html_cell.rb, section_cell.rb, summary_cell.rb, and two_pane_section_cell.rb.

RemediationAI

Upgrade decidim-core to the first non-vulnerable release for your branch: version 0.30.9 for 0.30.x deployments, version 0.31.5 for 0.31.x deployments, or version 0.32.0 for 0.32.x deployments. The upstream fix is confirmed merged in pull request https://github.com/decidim/decidim/pull/16451. If an immediate gem upgrade is not feasible, the vendor-documented compensating control is to restrict HTML content-block editing permissions exclusively to fully trusted administrators, eliminating the opportunity for a malicious or compromised account to inject content; the trade-off is reduced delegation flexibility in multi-admin environments. There is no technical workaround that neutralizes the vulnerability without either upgrading or removing landing-page editing access from non-essential accounts.