CVE-2026-45572 Details
Description
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editing privileges can store arbitrary HTML and JavaScript in an HTML content block, which Decidim::ContentBlocks::HtmlCell#html_content renders without sanitization, causing the script to execute in visitors' browsers. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
A stored cross-site scripting vulnerability has been identified in Decidim, a participatory democracy framework. This issue affects versions prior to 0.30.9, from 0.31.0 prior to 0.31.5, and in 0.32.0.rc1 prior to 0.32.0.rc2. The vulnerability arises when an administrator with landing-page editing privileges inserts arbitrary HTML and JavaScript into an HTML content block. The Decidim::ContentBlocks::HtmlCell#html_content method then renders this content without proper sanitization, allowing scripts to execute in the browsers of visitors.
Users can update to Decidim versions 0.30.9, 0.31.5, or 0.32.0.rc2 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 6, 2026CISA-ADP
Assessed Aug 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/decidim/decidim/pull/16451 | [email protected] | Issue TrackingVendor |
| https://github.com/decidim/decidim/security/advisories/GHSA-533c-2vh9-4r86 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Decidim | < 0.30.9 (semver) >= 0.31.0, < 0.31.5 (semver) >= 0.32.0.rc1, < 0.32.0.rc2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |