Decidim core versions before 0.30.9 contain a stored XSS vulnerability in the HTML content blocks of landing pages. An admin user with editing rights can insert arbitrary HTML/JavaScript into an HTML block, which is rendered back using `html_safe` without output escaping or sanitization in `Decidim::ContentBlocks::HtmlCell#html_content`. This allows the injected script to execute in the browsers of visitors viewing the affected page. The vulnerability requires privileged admin access to exploit, limiting the attack surface. The issue was identified during a security audit and fixed in Decidim 0.30.9.

An attacker with admin permissions to edit landing pages can persist JavaScript that executes in the browsers of page visitors. This can lead to information disclosure or other client-side impacts within the context of the affected page. Since exploitation requires high privileges, the risk is moderate rather than critical. There is no indication of remote unauthenticated exploitation or system-level compromise from this vulnerability.

A fix is available in Decidim version 0.30.9. Users should upgrade to this version or later to remediate the vulnerability. As a workaround, restrict admin permissions to trusted users only to prevent untrusted users from injecting malicious scripts. No other mitigations are specifically indicated.