Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

RubyGems package

decidim-elections

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.8RubyGemsAmendedPublished

    decidim-elections: Election question titles allow stored script execution

    CVE-2026-44282 · GHSA-9mvp-w4rr-5c6x

    Affected
    • RubyGems decidim-elections < 0.32.0
    Fixed in
    0.32.0· Vendor fix available
    Issue
    A low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical description This stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores question.body as a normal translatable string, and the public helper questiontitle returns that value with htmlsafe and no sanitization boundary, so any user who can edit election questions can persist markup or script-bearing payloads that later render on public election pages. <img width="1506" height="1285" alt="decidim-election-01" src="https://github.com/user-attachments/assets/2e17f396-10f9-4423-bb97-5badbdb20d21" / <img width="1540" height="657" alt="decidim-election-02" src="https://github.com/user-attachments/assets/178adb7b-d00e-4b5d-9237-f391e523973f" / Impact A low-privilege process-scoped admin or…

    Recommended action: Upgrade to 0.32.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →