decidim-elections
The participatory democracy framework. A generator and multiple gems made with Ruby on Rails
View on Github
Activity
- Latest release
- 1mo ago
- Total releases
- 71
- Cadence
- ~22 days
- Last 12 months
- 14
Reach
- Stars
- 1.8k
Details
- License
- unknown
- First release
- Sep 01, 2020
| Version | Released | |
|---|---|---|
0.32.1
patch
|
0.32.1
patch
Dependencies (6)
Changelog
Compare changes
|
|
0.31.7
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.31.7
patch
Dependencies (6)
Changelog
Compare changes
|
|
0.31.6
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.31.6
patch
Dependencies (6)
Changelog
Compare changes
|
|
0.32.0
minor
|
0.32.0
minor
Dependencies (6)
Changelog
Compare changes
|
|
0.32.0.rc3
pre
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.32.0.rc3
pre
Dependencies (6)
Changelog
Compare changes
|
|
0.32.0.rc2
pre
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.32.0.rc2
pre
Dependencies (6)
Changelog
Compare changes
|
|
0.31.5
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.31.5
patch
Dependencies (6)
Changelog
Compare changes
|
|
0.32.0.rc1
pre
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.32.0.rc1
pre
Dependencies (6)
Changelog
Compare changes
|
|
0.31.4
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.31.4
patch
Dependencies (6)
Changelog
Compare changes
|
|
0.31.3
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.31.3
patch
Dependencies (6)
Changelog
Compare changes
|
|
0.31.2
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.31.2
patch
Dependencies (6)
Changelog
Compare changes
|
|
0.31.1
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.31.1
patch
Dependencies (6)
Changelog
Compare changes
|
|
0.31.0
minor
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.31.0
minor
Dependencies (6)
Changelog
Compare changes
|
|
0.31.0.rc2
pre
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.31.0.rc2
pre
Dependencies (6)
Changelog
Compare changes
|
|
0.31.0.rc1
pre
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.31.0.rc1
pre
Dependencies (6)
Changelog
Compare changes
|
|
0.28.6
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.28.6
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.27.10
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.27.10
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.28.5
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.28.5
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.28.4
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.28.4
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.27.9
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.27.9
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.28.3
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.28.3
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.27.8
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.27.8
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.27.7
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.27.7
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.28.2
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.28.2
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.26.10
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.26.10
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.27.6
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.27.6
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.28.1
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.28.1
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.26.9
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.26.9
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.27.5
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.27.5
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.28.0
minor
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.28.0
minor
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.28.0.rc5
pre
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.28.0.rc5
pre
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.28.0.rc4
pre
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.28.0.rc4
pre
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.26.8
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.26.8
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.27.4
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.27.4
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.26.7
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.26.7
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.27.3
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.27.3
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.26.5
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.26.5
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.27.2
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.27.2
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.26.4
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.26.4
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.27.1
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.27.1
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.26.3
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.26.3
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.27.0
minor
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.27.0
minor
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.27.0.rc2
pre
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.27.0.rc2
pre
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.27.0.rc1
pre
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.27.0.rc1
pre
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.26.2
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.26.2
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.26.1
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.26.1
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.26.0
minor
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.26.0
minor
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.26.0.rc2
pre
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.26.0.rc2
pre
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.26.0.rc1
pre
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.26.0.rc1
pre
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
0.25.2
patch
1 CVE
CVE-2026-44282
GHSA-9mvp-w4rr-5c6x
Sep 09, 2026
decidim-elections: Election question titles allow stored script execution
4.8
/ 10
Medium
Network
Low
High
Required
Changed
Low
Low
None
DescriptionA low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical descriptionThis stored XSS appears because election question titles are rendered as trusted HTML instead of sanitized text. The election question editor stores ImpactA low-privilege process-scoped admin or other election editor with question-management rights can persist JavaScript that executes in visitor's browsers on public election pages and voting booth screens. PatchesSee https://github.com/decidim/decidim/pull/16659 WorkaroundsDevelopers should review their implementation's administrator accesses and not give access to untrustworthy users ResourcesOWASP XSS Injection CreditsThis issue was discovered in a security audit organized by the Decidim Association and made by Radically Open Security against Decidim financed by NGI. Affected versions
0.22.0
0.23.0
0.23.1
0.23.1.rc1
0.23.2
0.23.3
0.23.4
0.23.5
0.23.6
0.24.0
0.24.0.rc1
0.24.0.rc2
+ 57 more Show less
0.24.1
0.24.2
0.24.3
0.25.0
0.25.0.rc1
0.25.0.rc2
0.25.0.rc3
0.25.0.rc4
0.25.1
0.25.2
0.26.0
0.26.0.rc1
0.26.0.rc2
0.26.1
0.26.10
0.26.2
0.26.3
0.26.4
0.26.5
0.26.7
0.26.8
0.26.9
0.27.0
0.27.0.rc1
0.27.0.rc2
0.27.1
0.27.10
0.27.2
0.27.3
0.27.4
0.27.5
0.27.6
0.27.7
0.27.8
0.27.9
0.28.0
0.28.0.rc4
0.28.0.rc5
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.31.0
0.31.0.rc1
0.31.0.rc2
0.31.1
0.31.2
0.31.3
0.31.4
0.31.5
0.31.6
0.31.7
0.32.0.rc1
0.32.0.rc2
0.32.0.rc3
Fixed in
0.32.0
References Updated Sep 09, 2026 · Source: OSV.dev |
0.25.2
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|