CVE-2026-45572: Decidim HTML Content Blocks Allow Stored Vulnerability
MODERATECVE-2026-45572 is a MODERATE (CVSS 4.8) html content blocks allow stored vulnerability (CWE-94: Improper Control of Generation of Code ('Code Injection')) affecting Decidim libraries in the RubyGems ecosystem. The issue involves html content blocks allow stored script execution. Remediation is available by upgrading affected packages to version 0.30.9, 0.31.5, 0.32.0.
CVE-2026-45572 at a Glance
Security Impact
CVSS: 4.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N).
How to Fix CVE-2026-45572
To remediate this vulnerability, upgrade all affected Decidim dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade decidim-core to 0.30.9Upgrade decidim-core to 0.31.5Upgrade decidim-core to 0.32.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for decidim-coreHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-45572, inspect your project dependencies for Decidim:
inspect dependencies for decidim-coreAnalyze the terminal output to locate any version of Decidim in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.30.9), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-94: Improper Control of Generation of Code ('Code Injection'), where the product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. In Decidim, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-45572 Affected Decidim Versions
3 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
decidim-core
|
RubyGems |
< 0.30.9
|
0.30.9
|
|
decidim-core
|
RubyGems |
≥ 0.31.0.rc1
< 0.31.5
|
0.31.5
|
|
decidim-core
|
RubyGems |
≥ 0.32.0.rc1
< 0.32.0
|
0.32.0
|
References
Frequently Asked Questions
What is CVE-2026-45572?
Which Decidim versions are affected?
What version fixes CVE-2026-45572?
Is decidim-core affected?
What is the CVSS score of CVE-2026-45572?
What CWE is associated with CVE-2026-45572?
How can I check RubyGems dependencies for CVE-2026-45572?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-533c-2vh9-4r86",
"modified" : "2026-07-13T17:18:12Z",
"published" : "2026-07-13T17:18:12Z",
"aliases" : [ "CVE-2026-45572" ],
"summary" : "Decidim: HTML content blocks allow stored script execution",
"details" : "## Description\n \nA privileged admin user who can edit an affected landing page can store arbitrary HTML/JavaScript in an `HTML block`, and the public page renders it with `html_safe` and no output escaping.\n\n## Technical description\n \nThis issue lets any admin who can edit an affected landing page store arbitrary HTML and JavaScript in an `HTML block`. The block is then rendered back through `Decidim::ContentBlocks::HtmlCell#html_content` without a sanitization boundary, so the script executes later in visitor's browsers.\n\n<img width=\"1541\" height=\"439\" alt=\"decidim-html-xss-01\" src=\"https://github.com/user-attachments/assets/acae1c06-8acb-49be-ab12-aabae33190ce\" />\n\n<img width=\"1540\" height=\"752\" alt=\"decidim-html-xss-02\" src=\"https://github.com/user-attachments/assets/a2f1fa7f-03f3-4d17-b58b-f4db865443e9\" />\n\n\n### Impact\n\n- A user with landing-page editing rights for an affected scope can persist JavaScript that executes in visitor's browsers on that page.\n- Because exploitation already requires privileged administrative access, the practical risk is lower than a participant-controlled or unauthenticated stored XSS. It still creates a browser-execution primitive in a trusted admin-editable surface.\n\n### Patches\n\nSee https://github.com/decidim/decidim/pull/16451 \n\n### Workarounds\n\nDo not give admin permissions to non-trustful users. \n\n### Reference\n\nStored XSS\n\n### Credits\n\nThis issue was discovered in a security audit organized by the [Decidim Association](https://decidim.org) and made by [Radically Open Security](https://www.radicallyopensecurity.com/) against Decidim financed by [NGI](https://ngi.eu/).",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "RubyGems",
"name" : "decidim-core"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.30.9"
} ]
} ]
}, {
"package" : {
"ecosystem" : "RubyGems",
"name" : "decidim-core"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0.31.0.rc1"
}, {
"fixed" : "0.31.5"
} ]
} ]
}, {
"package" : {
"ecosystem" : "RubyGems",
"name" : "decidim-core"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0.32.0.rc1"
}, {
"fixed" : "0.32.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/decidim/decidim/security/advisories/GHSA-533c-2vh9-4r86"
}, {
"type" : "WEB",
"url" : "https://github.com/decidim/decidim/pull/16451"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/decidim/decidim"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-94" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-07-13T17:18:12Z",
"nvd_published_at" : null
}
}