THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-9mvp-w4rr-5c6x (medium) — decidim-elections: Election question titles allow stored script execution

[GHSA] GHSA-9mvp-w4rr-5c6x (medium) — decidim-elections: Election question titles allow stored script execution

highgithub_advisoriesPublished 2026-09-09

GHSA-9mvp-w4rr-5c6x Severity: medium CVE: CVE-2026-44282

decidim-elections: Election question titles allow stored script execution

## Description

A low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely.

## Technical description

This stored XSS appears be

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-44282cve
https://decidim.orgurl
https://www.radicallyopensecurity.com/url
https://ngi.eu/url

Original source: https://github.com/advisories/GHSA-9mvp-w4rr-5c6x