CVE-2026-44282

Executive Summary

CVE-2026-44282 is a stored cross-site scripting (XSS) vulnerability in Decidim, an open-source participatory democracy framework, affecting all versions prior to 0.32.0. A low-privilege, process-scoped administrator or election editor with question-management rights can persist script-bearing content into the translatable question.body field, which is rendered unsanitized via the question_title helper using html_safe. The impact is stored script execution in the browsers of unauthenticated visitors viewing public election pages or voting booth screens, enabling session or credential theft, content manipulation, and actions performed in the context of affected visitors.

Technical Analysis

Decidim is a Ruby on Rails–based participatory democracy platform used by municipalities, NGOs, and public institutions to run participatory budgeting, elections, and consultation processes. This vulnerability is a classic stored (persistent) cross-site scripting issue (CWE-79) arising from the absence of an output-sanitization boundary.

Per the NVD description, the root cause is twofold:

1. Insufficient input handling on the write path. A low-privilege, process-scoped administrator or election editor holding question-management rights can store HTML or script-bearing content in the question.body field. The description implies the field permits translatable content, and that the platform does not adequately reject or neutralize markup supplied by this (privileged-but-low) role.

2. Unsafe output rendering on the read path. The question_title helper returns the translatable question body "through html_safe without a sanitization boundary." In Rails, html_safe marks a string as trusted HTML, instructing the framework not to perform automatic escaping when the value is inserted into a view. When applied to user-controllable content, this disables the platform's default XSS protection for that value. Consequently, stored script content is emitted to the DOM as executable markup rather than escaped text.

The attack surface is the election/question authoring interface (where question.body is submitted) and the public election pages and voting booth screens (where question_title-rendered output is displayed). Critically, the exploit destination renders to visitors, i.e., potentially unauthenticated users of public election pages and shared voting booth screens. This distinguishes the issue from a self-contained admin XSS: the payload persists server-side and detonates in the browser of any subsequent visitor.

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (4.8 Medium) reflects a network-reachable flaw requiring high privileges (the low-privilege editor role is still an authenticated, privileged account relative to anonymous users), user interaction in the form of a victim opening a poisoned page, and a scope change (S:C) because the script executes in visitors' browser context rather than the editor's. Confidentiality and integrity impacts are limited (C:L/I:L); there is no availability impact.

Because the vulnerability is stored, no crafted link is required for the victim — visiting the normal public election page or voting booth screen is sufficient once malicious content exists. Patches are claimed for 0.32.0 from a single source (OSV) and have not been independently confirmed. No public PoC, exploit code, or Nuclei template exists; EPSS is low (0.00369, 30.5th percentile).

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class (stored XSS via unsafe output encoding) and the details provided in the NVD description. No function names, parameters, or endpoints beyond those named in the description are asserted.

1. Reconnaissance / target identification. The attacker identifies a Decidim instance running a version prior to 0.32.0 whose public election pages or voting booth screens are reachable. Any instance exposing election questions to untrusted editors and public visitors is in scope.

2. Prerequisite access. The attacker must possess an account with process-scoped administrator or election editor privileges and question-management rights. This is a legitimate but low-privilege role, meaning the barrier is an insider, a compromised low-privilege account, or a delegated election editor.

3. Triggering the flaw class. Through the question-management functionality, the attacker stores HTML or script-bearing content into the question.body field. The field accepts translatable content and lacks adequate neutralizing of markup on input.

4. Payload delivery / execution. No victim click on an attacker-crafted link is needed. When any visitor opens the public election page or a voting booth screen, the question_title helper returns the stored question.body value through html_safe, so the embedded script is inserted into the page as executable markup and runs in the visitor's browser.

5. Post-exploitation impact. The persisted script executes in visitors' browsers. At the vulnerability-class level, this typically enables theft of session material or credentials visible to page scripts, manipulation of displayed election/question content (undermining trust in results or instructions), redirection or injection of further content, and performing actions in the visitor's context on the affected origin. Scope is elevated (S:C) because execution occurs in the visitors' context, not the editor's.

Impact Assessment

The primary impact is integrity and confidentiality compromise of the browsing sessions of visitors to election-related pages, including potentially unauthenticated members of the public and users of shared voting booth screens. Because the payload is stored, every subsequent visitor to the poisoned page is exposed until the content is removed — a broad, persistent blast radius proportional to page traffic.

CVSS subscores: AV:N (remotely reachable web interface), AC:L (no special conditions beyond stored content), PR:H (requires an authenticated editor/administrator role), UI:R (victim must open the affected page), S:C (script executes in the visitors' browser context, a different security scope from the vulnerable authoring component), C:L/I:L (limited confidentiality and integrity impact), A:N (no availability impact). Base score 4.8 (Medium).

Business impact for government, municipal, and civic organizations is significant relative to the numeric score: Decidim powers democratic processes where public trust, election integrity, and voter privacy are paramount. Injected content on election pages can mislead voters, and script execution in visitor browsers can harvest session or credential material. There is no CISA KEV listing and no known in-the-wild exploitation evidence; EPSS is low. The flaw should nonetheless be treated as high-priority for civic-sector deployments because of the trust-sensitive context.

Detection Guidance

Sigma Rule

title: Potential Stored XSS via Decidim question.body Content
id: 7a1c9e42-0d2b-4f17-9c53-2b8e5a6d1f08
status: experimental
description: Detects storage of HTML/script-bearing content into Decidim question body fields, consistent with CVE-2026-44282 stored XSS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-44282
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains:
      - '/questions'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - '<img'
      - '<svg'
  condition: selection_method and selection_uri and selection_payload
falsepositives:
  - Legitimate rich-text formatting submitted by trusted editors
level: medium
tags:
  - attack.t1059.007
  - cwe.79

YARA Rule

rule CVE_2026_44282_Decidim_StoredXSS
{
    meta:
        description = "Detects script-bearing payloads targeting Decidim question.body stored XSS (CVE-2026-44282)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-44282"
        date = "2026-01-01"
    strings:
        $field = "question" ascii nocase
        $body  = "body" ascii nocase
        $s1 = "<script" ascii nocase
        $s2 = "onerror=" ascii nocase
        $s3 = "onload=" ascii nocase
        $s4 = "javascript:" ascii nocase
        $s5 = "<img" ascii nocase
        $s6 = "<svg" ascii nocase
    condition:
        filesize < 1MB and
        (any of ($s1, $s2, $s3, $s4, $s5, $s6))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-44282 Decidim question.body Stored XSS Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"question"; nocase; http.request_body; pcre:"/(<script|onerror\s*=|onload\s*=|javascript:|<svg|<img)/i"; reference:cve,2026-44282; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-44282; classtype:web-application-attack; sid:202644282; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "POST" and
      stringContains(http.request.body, "question") ]
  [ network where stringContains(http.request.body, "<script") or
      stringContains(http.request.body, "onerror=") or
      stringContains(http.request.body, "onload=") or
      stringContains(http.request.body, "javascript:") ]

Splunk SPL Query

index=web sourcetype=access_combined (cs_method=POST)
| where match(uri, "(?i)question")
| where match(form_data, "(?i)(<script|onerror\s*=|onload\s*=|javascript:|<svg|<img)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, user
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,decidim,xss,">
  <rule id="2026442" level="10">
    <if_sid>31100</if_sid>
    <url>question</url>
    <description>CVE-2026-44282: Possible Decidim question.body stored XSS payload submission</description>
    <group>cve_2026_44282,xss,web_attack,</group>
  </rule>
  <rule id="2026443" level="12">
    <if_sid>2026442</if_sid>
    <match>&lt;script|onerror=|onload=|javascript:|&lt;svg</match>
    <description>CVE-2026-44282: Script-bearing content detected in Decidim question submission</description>
    <group>cve_2026_44282,xss,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch; not independently confirmed).

1. Immediate mitigations

   • Restrict question-management rights to the smallest possible set of trusted accounts; audit existing process-scoped administrators and election editors.
   • Review and remediate all stored question.body content for HTML/script-bearing markup, particularly on published election pages and voting booth screens.
   • Deploy a web application firewall / reverse-proxy output and input filtering profile capable of blocking obvious script-bearing markup on question submission and delivery paths.
   • Enable a restrictive Content-Security-Policy to reduce the impact of any residual inline script execution.

2. Patch / upgrade steps

   • Upgrade Decidim to 0.32.0 or later, where the vulnerability is claimed to be fixed. Because patch confidence is only 2/4 (single source, unconfirmed), validate the fix in a staging environment by confirming that stored markup in question.body is escaped rather than rendered via html_safe before rolling out to production.
   • Monitor the official Decidim project channels and OSV for an authoritative advisory and patch verification.

3. Long-term hardening

   • Enforce consistent output encoding: avoid html_safe on any user- or editor-supplied value unless passed through a vetted sanitizer with an explicit allowlist.
   • Adopt context-aware auto-escaping and HTML sanitization libraries for rich-text fields, with allowlisting of permitted tags and attributes.
   • Implement role-based least privilege and regular access reviews for election/process administration.
   • Add regression tests that assert script-bearing content is neutralized across all election-facing views.

References

• NVD — CVE-2026-44282: https://nvd.nist.gov/vuln/detail/CVE-2026-44282
• OSV — Decidim advisory entry (patch source, single source): https://osv.dev/
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1059.007 — JavaScript: https://attack.mitre.org/techniques/T1059/007/
• Decidim project (official repository and release notes for 0.32.0): https://github.com/decidim/decidim

No public PoC, exploit code, or Nuclei template is known. No CISA KEV listing and no confirmed in-the-wild exploitation or attributed threat actor campaigns were identified in the provided data.