Description

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editing privileges can store arbitrary HTML and JavaScript in an HTML content block, which Decidim::ContentBlocks::HtmlCell#html_content renders without sanitization, causing the script to execute in visitors' browsers. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-08-06T22:17:07.403Z",
  "pubdate": "2026-08-06T22:17:07.403Z",
  "executiveSummary": "A stored Cross-Site Scripting (XSS) vulnerability exists within the Decidim participatory democracy framework. The flaw resides in the handling of HTML content blocks managed by administrators with landing-page editing privileges. Specifically, the component renders stored content without proper sanitization, allowing arbitrary HTML and JavaScript execution within the context of site visitors' browsers.\nThe primary impact of this vulnerability is the potential execution of malicious scripts in the sessions of unsuspecting users visiting the compromised landing page. This can lead to session hijacking, credential theft, defacement, or unauthorized actions performed on behalf of authenticated users.\nAffected products include Decidim prior to version 0.30.9, versions from 0.31.0 before 0.31.5, and version 0.32.0.rc1 prior to 0.32.0.rc2. Exploitation requires administrative privileges specifically granting landing-page editing capabilities, combined with the ability to inject malicious payloads into HTML content blocks.\nRisk implications are severe due to the inherent trust associated with administrator accounts and landing pages. Successful exploitation compromises the integrity and confidentiality of the web application session data for all visitors encountering the rendered payload.",
  "technicalDetails": "The root cause of the vulnerability is the absence of input sanitization and output encoding within the Decidim::ContentBlocks::HtmlCell#html_content function. When an administrator creates or updates an HTML content block on the landing page, the provided string payload is stored directly in the persistence layer without validation or sanitization of dangerous HTML tags and JavaScript constructs.\nUpon a visitor requesting the affected landing page, the vulnerable component Decidim::ContentBlocks::HtmlCell#html_content retrieves the raw, unescaped payload from the database and emits it directly into the Document Object Model (DOM) of the response without contextual output encoding. Consequently, the browser parses the injected script tags or event handlers as executable code rather than plain text.\nThe attack flow follows a sequential vector: First, an adversary authenticates with privileges allowing landing-page administration. Second, the attacker accesses the HTML content block editing interface. Third, the attacker injects a malicious payload containing arbitrary HTML and JavaScript into the content block and saves the configuration. Finally, any visitor accessing the public landing page triggers the execution of the stored payload within their browser session.\nAuthentication and privilege requirements mandate an attacker to possess administrative privileges with specific authorization for landing-page editing. Network exposure is present wherever Decidim instances expose their administrative interfaces and public-facing landing pages over HTTP or HTTPS.\nPayload behavior encompasses client-side script execution, enabling attackers to interact with the Document Object Model, access session tokens, manipulate cookies, or execute arbitrary API requests within the security context of the victim's browser session. Post-exploitation impact includes unauthorized actions, data exfiltration, and session compromise.\nVulnerable versions comprise Decidim prior to 0.30.9, versions ranging from 0.31.0 prior to 0.31.5, and version 0.32.0.rc1 prior to 0.32.0.rc2."
}