Merge pull request #1240 from jasnow/sep-10-advs

GHSA/SYNC: One new decidim-elections advisory

@flavorjones - Thanks for reviewing and approving this PR.

Author: jasnow

gems/decidim-elections/CVE-2026-44282.yml

@@ -0,0 +1,44 @@
+---
+gem: decidim-elections
+cve: 2026-44282
+ghsa: 9mvp-w4rr-5c6x
+url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-44282
+title: decidim-elections - Election question titles allow stored script execution
+date: 2026-07-06
+description: |
+  ## Description
+
+  A low-privilege process-scoped admin who can manage elections can
+  store arbitrary HTML in the question statement/body without
+  sanitization, and the public elections UI renders that value unsafely.
+
+  ## Impact
+
+  A low-privilege process-scoped admin or other election editor with
+  question-management rights can persist JavaScript that executes in
+  visitor's browsers on public election pages and voting booth screens.
+
+  ### Credits
+
+  This issue was discovered in a security audit organized by the
+  [Decidim Association](https://decidim.org) and made by
+  [Radically Open Security](https://www.radicallyopensecurity.com/)
+  against Decidim financed by [NGI](https://ngi.eu/).
+cvss_v3: 4.8
+patched_versions:
+  - ">= 0.32.0"
+related:
+  url:
+    - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-44282
+    - https://rubygems.org/gems/decidim-elections/versions/0.32.0
+    - https://github.com/decidim/decidim/releases#release-v0.32.0
+    - https://github.com/decidim/decidim/pull/16659
+    - https://advisories.gitlab.com/gem/decidim-elections/CVE-2026-44282
+    - https://github.com/decidim/decidim/security/advisories/GHSA-9mvp-w4rr-5c6x
+    - https://github.com/advisories/GHSA-9mvp-w4rr-5c6x
+notes: |
+  - cvss_v3 from GHSA URL.
+  - date from Release Notes URL.
+    - Gem was released on 7/2/2026.
+  - CVE is reserved, but not published and not on nvd.nist.gov web site.
+  - NOTE: Repo name is "decidim" and gem name is "decidim-elections".