EUVD-2026-349361

fkie_cve-2026-45572

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editing privileges can store arbitrary HTML and JavaScript in an HTML content block, which Decidim::ContentBlocks::HtmlCell#html_content renders without sanitization, causing the script to execute in visitors' browsers. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

GHSA-533c-2vh9-4r86 — Decidim: HTML content blocks allow stored script execution

Affected: RubyGems: decidim-core

## Description A privileged admin user who can edit an affected landing page can store arbitrary HTML/JavaScript in an `HTML block`, and the public page renders it with `html_safe` and no output escaping.

## Technical description This issue lets any admin who can edit an affected landing page store arbitrary HTML and JavaScript in an `HTML block`. The block is then rendered back through `Decidim::ContentBlocks::HtmlCell#html_content` without a sanitization boundary, so the script executes later in visitor's browsers.

### Impact

- A user with landing-page editing rights for an affected scope can persist JavaScript that executes in visitor's browsers on that page. - Because exploitation already requires privileged administrative access, the practical risk is lower than a participant-controlled or unauthenticated stored XSS. It still creates a browser-execution primitive in a trusted admin-editable surface.

### Patches

See https://github.com/decidim/decidim/pull/16451

### Workarounds

Do not give admin permissions to non-trustful users.

### Reference

Stored XSS

### Credits

This issue was discovered in a security audit organized by the [Decidim Association](https://decid…

Most recent entries from all

EUVD-2026-349361

fkie_cve-2026-45572

GHSA-533c-2vh9-4r86 — Decidim: HTML content blocks allow stored script execution