Updated advisory posts against rubysec/ruby-advisory-db@1df8058

Author: jasnow

advisories/_posts/2026-07-06-CVE-2026-44282.md

@@ -0,0 +1,52 @@
+---
+layout: advisory
+title: 'CVE-2026-44282 (decidim-elections): decidim-elections - Election question
+  titles allow stored script execution'
+comments: false
+categories:
+- decidim-elections
+advisory:
+  gem: decidim-elections
+  cve: 2026-44282
+  ghsa: 9mvp-w4rr-5c6x
+  url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-44282
+  title: decidim-elections - Election question titles allow stored script execution
+  date: 2026-07-06
+  description: |-
+    ## Description
+
+    A low-privilege process-scoped admin who can manage elections can
+    store arbitrary HTML in the question statement/body without
+    sanitization, and the public elections UI renders that value unsafely.
+
+    ## Impact
+
+    A low-privilege process-scoped admin or other election editor with
+    question-management rights can persist JavaScript that executes in
+    visitor's browsers on public election pages and voting booth screens.
+
+    ### Credits
+
+    This issue was discovered in a security audit organized by the
+    [Decidim Association](https://decidim.org) and made by
+    [Radically Open Security](https://www.radicallyopensecurity.com/)
+    against Decidim financed by [NGI](https://ngi.eu/).
+  cvss_v3: 4.8
+  patched_versions:
+  - ">= 0.32.0"
+  related:
+    url:
+    - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-44282
+    - https://rubygems.org/gems/decidim-elections/versions/0.32.0
+    - https://github.com/decidim/decidim/releases#release-v0.32.0
+    - https://github.com/decidim/decidim/pull/16659
+    - https://advisories.gitlab.com/gem/decidim-elections/CVE-2026-44282
+    - https://github.com/decidim/decidim/security/advisories/GHSA-9mvp-w4rr-5c6x
+    - https://github.com/advisories/GHSA-9mvp-w4rr-5c6x
+  notes: |
+    - cvss_v3 from GHSA URL.
+    - date from Release Notes URL.
+      - Gem was released on 7/2/2026.
+    - CVE is reserved, but not published and not on nvd.nist.gov web site.
+    - NOTE: Repo name is "decidim" and gem name is "decidim-elections".
+---