CVE-2026-44282

Decidim is a participatory democracy framework. Prior to 0.32.0, a low-privilege process-scoped administrator or election editor with question-management rights can store HTML or script-bearing content in question.body. The questiontitle helper returns the translatable question body through...

CVE-2026-44282 Election question titles allow stored script execution

Decidim is a participatory democracy framework. Prior to 0.32.0, a low-privilege process-scoped administrator or election editor with question-management rights can store HTML or script-bearing content in question.body. The questiontitle helper returns the translatable question body through...

CVE-2026-44282

Decidim (a participatory democracy framework), specifically the decidim-elections component, is affected by a stored cross-site scripting (XSS) vulnerability prior to version 0.32.0 . The root cause is that the question_title helper renders question.body via html_safe without a sanitization bound...