Executive brief
Decidim is a participatory democracy platform that includes an elections module for conducting online votes. A stored cross-site scripting (XSS) vulnerability in election question titles allows low-privilege admins to inject malicious scripts that execute in the browsers of all election participants and public viewers. An attacker with admin access to elections could steal voter credentials, manipulate voting displays, or hijack user sessions.
Technical details
This is a stored XSS vulnerability arising from unsafe HTML rendering in the decidim-elections gem. The vulnerable component is the `question_title` helper, which returns election question body text with `html_safe` called directly without any sanitization or escaping. An authenticated admin user with question-management permissions can edit the `question.body` field and persist arbitrary HTML or JavaScript payloads. When public election pages or voting booth screens render these questions, the unsanitized markup executes in visitors' browsers. The attack requires network access, high privileges (admin account), and user interaction (victim visiting the election page), but has cross-scope impact (affects multiple users). A patch is available in Decidim 0.32.0 via pull request #16659, which escapes question titles during rendering.
Affected products
- Decidim decidim-elections < 0.32.0
Timeline
- 2026-09-07: disclosed: Vulnerability published as GHSA-9mvp-w4rr-5c6x
- 2026-09-07: patched: Fixed in decidim-elections 0.32.0 via PR #16659