CVE-2026-45572 in Decidim
Summary
by MITRE • 08/07/2026
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editing privileges can store arbitrary HTML and JavaScript in an HTML content block, which Decidim::ContentBlocks::HtmlCell#html_content renders without sanitization, causing the script to execute in visitors' browsers. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability affects the Decidim participatory democracy framework and represents a critical cross-site scripting flaw that allows administrators with landing-page editing privileges to inject malicious code into content blocks. The issue stems from insufficient input sanitization within the Decidim::ContentBlocks::HtmlCell#html_content rendering mechanism, which processes HTML content without proper validation or sanitization. This creates an environment where arbitrary JavaScript code can be stored and executed in visitors' browsers, effectively transforming legitimate administrative functionality into a vector for malicious attacks.
The technical flaw manifests as a failure to implement proper content security measures when handling user-generated HTML content within the framework's content management system. According to CWE-79, this vulnerability directly maps to Cross-Site Scripting (XSS) issues that occur when untrusted data is integrated into web pages without adequate sanitization or encoding. The vulnerability exists across multiple version ranges including 0.30.0 through 0.30.8, 0.31.0 through 0.31.4, and 0.32.0.rc1 through 0.32.0.rc1, indicating a persistent flaw in the framework's content handling mechanisms.
The operational impact of this vulnerability is significant as it provides attackers with a means to execute arbitrary code in the context of users' browsers who visit pages containing malicious content. This could enable session hijacking, credential theft, defacement of public-facing participatory democracy platforms, or redirection to malicious sites. The attack vector requires only administrative access to landing-page editing privileges, making it particularly dangerous as it leverages legitimate administrative functionality rather than requiring additional privilege escalation. The vulnerability affects all visitors to pages containing compromised HTML content blocks, potentially exposing large user bases to malicious code execution.
From an ATT&CK framework perspective, this vulnerability aligns with techniques such as T1059.007 (Command and Scripting Interpreter: JavaScript) and T1531 (Account Access Removal), as it enables attackers to execute malicious scripts in user contexts and potentially compromise user sessions. The mitigation strategy involves updating to the fixed versions 0.30.9, 0.31.5, and 0.32.0.rc2 where proper HTML sanitization has been implemented. Organizations should also consider implementing additional security measures such as content security policies, regular security audits of user-generated content, and monitoring for unauthorized administrative access attempts. The fix demonstrates the importance of input validation and output encoding in preventing XSS vulnerabilities, aligning with security best practices outlined in OWASP Top Ten and NIST cybersecurity guidelines for web application security.