diff --git a/spec/forms/registration_form_spec.rb b/spec/forms/registration_form_spec.rb
index b720bd7..af6c990 100644
--- a/spec/forms/registration_form_spec.rb
+++ b/spec/forms/registration_form_spec.rb
@@ -74,5 +74,11 @@ module Decidim
         end
       end
     end
+
+    context "when email contains a script tag" do
+      let(:email) { "<script>alert('XSS')</script>@example.org" }
+
+      it { is_expected.to be_invalid }
+    end
   end
 end