CVE-2026-45572

Received Received - Intake

Stored XSS in Decidim HTML Content Blocks

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editing privileges can store arbitrary HTML and JavaScript in an HTML content block, which Decidim::ContentBlocks::HtmlCell#html_content renders without sanitization, causing the script to execute in visitors' browsers. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-45572

Affected Vendors & Products

Vendor	Product	Version / Range
decidim	decidim	to 0.30.9 (inc)
decidim	decidim	From 0.31.0 (inc) to 0.31.5 (exc)
decidim	decidim	From 0.32.0.rc1 (inc) to 0.32.0.rc2 (exc)
decidim	decidim	to 0.32.0.rc2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Decidim participatory democracy framework. An administrator with landing-page editing privileges can inject arbitrary HTML and JavaScript into an HTML content block. When rendered by Decidim::ContentBlocks::HtmlCell#html_content, the unsanitized content executes in visitors' browsers, leading to potential cross-site scripting (XSS) attacks.

Impact Analysis

An attacker could exploit this to steal user sessions, deface the website, or perform actions on behalf of users. Visitors to the site may have their data compromised or be redirected to malicious sites without their knowledge.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection requirements. For HIPAA, it may compromise protected health information if user sessions or data are exposed. Organizations must address this to maintain compliance.

Mitigation Strategies

Update Decidim to version 0.30.9, 0.31.5, or 0.32.0.rc2 or later to fix the vulnerability. Remove or restrict administrator privileges for users who can edit landing pages until the update is applied.

Hi! I’m here to help you understand CVE-2026-45572. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70