EUVD-2026-78669
GHSA-9mvp-w4rr-5c6x
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
PR:H reflects the required election-editor admin role; S:C because payload executes in victims' browser context; UI:R for victim page visit; no availability impact.
Primary rating from Vendor (https://github.com/decidim/decidim).
CVSS VectorVendor: https://github.com/decidim/decidim
Lifecycle Timeline
2DescriptionCVE.org
Description
A low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely.
Technical description
This stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores question.body as a normal translatable string, and the public helper question_title returns that value with html_safe and no sanitization boundary, so any user who can edit election questions can persist markup or script-bearing payloads that later render on public election pages.
<img width="1506" height="1285" alt="decidim-election-01" src="https://github.com/user-attachments/assets/2e17f396-10f9-4423-bb97-5badbdb20d21" /> <img width="1540" height="657" alt="decidim-election-02" src="https://github.com/user-attachments/assets/178adb7b-d00e-4b5d-9237-f391e523973f" />
Impact
A low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens.
Patches
See https://github.com/decidim/decidim/pull/16659
Workarounds
Developers should review their implementation's administrator accesses and not give access to untrustworthy users
Resources
OWASP XSS Injection
Credits
This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.
AnalysisAI
Stored XSS in the decidim-elections Ruby gem (versions before 0.32.0) allows a process-scoped admin or election editor with question-management rights to persist arbitrary JavaScript in election question body fields, which subsequently executes in the browsers of all public visitors and voters accessing affected election pages. The root cause is the question_title helper in application_helper.rb returning question.body marked .html_safe without any sanitization boundary, bypassing Rails' automatic HTML escaping. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a process-scoped admin account or another Decidim role explicitly granted election question-management rights - these are privileged application accounts, not general public user accounts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, score 4.8) accurately captures the key risk parameters: exploitation requires high privileges (a legitimately credentialed election-editor or process-scoped admin), and real-world harm requires a victim browser to load the affected page. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade decidim-elections to version 0.32.0 or later, which removes the `.html_safe` call from the `question_title` helper (see PR https://github.com/decidim/decidim/pull/16659 and advisory https://github.com/decidim/decidim/security/advisories/GHSA-9mvp-w4rr-5c6x). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today