CVE-2026-44282
- Source
- https://cve.org/CVERecord?id=CVE-2026-44282
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44282.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-44282
- Aliases
- Published
- 2026-09-15T15:25:56Z
- Modified
- 2026-10-28T02:30:32Z
- Severity
-
- 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- Election question titles allow stored script execution
- Details
-
Decidim is a participatory democracy framework. Prior to 0.32.0, a low-privilege process-scoped administrator or election editor with question-management rights can store HTML or script-bearing content in question.body. The question_title helper returns the translatable question body through html_safe without a sanitization boundary, causing stored script execution when visitors open public election pages or voting booth screens. The persisted script executes in visitors' browsers. The vulnerability is fixed in 0.32.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44282.json" }- References
-
- https://github.com/decidim/decidim/releases/tag/v0.32.0
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44282.json
- https://github.com/decidim/decidim/security/advisories/GHSA-9mvp-w4rr-5c6x
- https://nvd.nist.gov/vuln/detail/CVE-2026-44282
- https://github.com/decidim/decidim/commit/64dbea3739f360f1eb36932dfc49d9686e61fc00
- https://github.com/decidim/decidim/commit/b6e1b003365d10c0df2bc7edc5edd26b62fafda1
- https://github.com/decidim/decidim/pull/16659
- https://github.com/decidim/decidim/pull/16669
Affected packages
Git / github.com/decidim/decidim
Affected ranges
- Type
- GIT
- Repo
- https://github.com/decidim/decidim
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "0.32.0" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "64dbea3739f360f1eb36932dfc49d9686e61fc00" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "b6e1b003365d10c0df2bc7edc5edd26b62fafda1" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v0.32.0", "range": [ { "fixed": "f891077eb17bccc05afb1ba65c5c3073e811703c" } ], "source": "REFERENCES_TAG" } ] }