From 5130a132e5c4c90616715262377524d8878b47f2 Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Thu, 10 Sep 2026 11:25:04 -0400
Subject: [PATCH] GHSA/SYNC: One new advisory

---
 gems/decidim-elections/CVE-2026-44282.yml | 44 +++++++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 gems/decidim-elections/CVE-2026-44282.yml

diff --git a/gems/decidim-elections/CVE-2026-44282.yml b/gems/decidim-elections/CVE-2026-44282.yml
new file mode 100644
index 0000000000..7de4ec0c09
--- /dev/null
+++ b/gems/decidim-elections/CVE-2026-44282.yml
@@ -0,0 +1,44 @@
+---
+gem: decidim-elections
+cve: 2026-44282
+ghsa: 9mvp-w4rr-5c6x
+url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-44282
+title: decidim-elections - Election question titles allow stored script execution
+date: 2026-07-06
+description: |
+  ## Description
+
+  A low-privilege process-scoped admin who can manage elections can
+  store arbitrary HTML in the question statement/body without
+  sanitization, and the public elections UI renders that value unsafely.
+
+  ## Impact
+
+  A low-privilege process-scoped admin or other election editor with
+  question-management rights can persist JavaScript that executes in
+  visitor's browsers on public election pages and voting booth screens.
+
+  ### Credits
+
+  This issue was discovered in a security audit organized by the
+  [Decidim Association](https://decidim.org) and made by
+  [Radically Open Security](https://www.radicallyopensecurity.com/)
+  against Decidim financed by [NGI](https://ngi.eu/)."
+cvss_v3: 4.8
+patched_versions:
+  - ">= 0.32.0"
+related:
+  url:
+    - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-44282
+    - https://rubygems.org/gems/decidim-elections/versions/0.32.0
+    - https://github.com/decidim/decidim/releases#release-v0.32.0
+    - https://github.com/decidim/decidim/pull/16659
+    - https://advisories.gitlab.com/gem/decidim-elections/CVE-2026-44282
+    - https://github.com/decidim/decidim/security/advisories/GHSA-9mvp-w4rr-5c6x
+    - https://github.com/advisories/GHSA-9mvp-w4rr-5c6x
+notes: |
+  - cvss_v3 from GHSA URL.
+  - date from Release Notes URL.
+    - Gem was released on 7/2/2026.
+  - CVE is reserved, but not published and not on nvd.nist.gov web site.
+  - NOTE: Repo name is "decidim" and gem name is "decidim-elections".