GHSA-9mvp-w4rr-5c6x

Suggest an improvement
Source
https://github.com/advisories/GHSA-9mvp-w4rr-5c6x
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9mvp-w4rr-5c6x/GHSA-9mvp-w4rr-5c6x.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-9mvp-w4rr-5c6x
Aliases
Published
2026-09-09T17:59:52Z
Modified
2026-09-09T18:25:58Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
decidim-elections: Election question titles allow stored script execution
Details

Description

A low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely.

Technical description

This stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores question.body as a normal translatable string, and the public helper question_title returns that value with html_safe and no sanitization boundary, so any user who can edit election questions can persist markup or script-bearing payloads that later render on public election pages.

decidim-election-01 decidim-election-02

Impact

A low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens.

Patches

See https://github.com/decidim/decidim/pull/16659

Workarounds

Developers should review their implementation's administrator accesses and not give access to untrustworthy users

Resources

OWASP XSS Injection

Credits

This issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI.

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-09T17:59:52Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

RubyGems / decidim-elections

Package

Name
decidim-elections
Purl
pkg:gem/decidim-elections

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.32.0

Affected versions

0.*
0.22.0
0.23.0
0.23.1.rc1
0.23.1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0.rc1
0.24.0.rc2
0.24.0
0.24.1
0.24.2
0.24.3
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.0
0.25.1
0.25.2
0.26.0.rc1
0.26.0.rc2
0.26.0
0.26.1
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.26.10
0.27.0.rc1
0.27.0.rc2
0.27.0
0.27.1
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.27.10
0.28.0.rc4
0.28.0.rc5
0.28.0
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0.rc1
0.31.0.rc2
0.31.0
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9mvp-w4rr-5c6x/GHSA-9mvp-w4rr-5c6x.json"