GHSA-53p3-c7vp-4mcc
NoneCVSS
—
EPSS
—
Published
Mar 29, 2026
CISA due date
—
The record
Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| RubyGems | action_text-trix | 0 | 2.1.18 |
| npm | trix | 0 | 2.1.18 |
| Chainguard | ruby3.2-rails-8.1 | 0 | 8.1.3-r1 |
| Chainguard | ruby3.3-rails-8.1 | 0 | 8.1.3-r1 |
| Chainguard | ruby3.4-rails-8.1 | 0 | 8.1.3-r1 |
| Chainguard | ruby4.0-rails-8.1 | 0 | 8.1.3-r1 |
| Wolfi | ruby3.2-rails-8.1 | 0 | 8.1.3-r1 |
| Wolfi | ruby3.3-rails-8.1 | 0 | 8.1.3-r1 |
| Wolfi | ruby3.4-rails-8.1 | 0 | 8.1.3-r1 |
| Wolfi | ruby4.0-rails-8.1 | 0 | 8.1.3-r1 |
Related vulnerabilities
- GHSA-qmpg-8xg6-ph5q Trix has a Stored XSS vulnerability through serialized attributes Also affects action_text-trix
- GHSA-g9jg-w8vm-g96v Trix has a stored XSS vulnerability through its attachment attribute Also affects action_text-trix
- CVE-2024-43368 The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious… Also affects trix
- CVE-2024-34341 Trix is a rich text editor. Also affects trix
- CVE-2026-33202 Active Storage allows users to attach cloud and local files in Rails applications. Also affects ruby3.2-rails-8.1
- CVE-2026-33170 Active Support is a toolkit of support libraries and Ruby core extensions extracted from… Also affects ruby3.2-rails-8.1
- CVE-2026-33173 Active Storage allows users to attach cloud and local files in Rails applications. Also affects ruby3.2-rails-8.1
- CVE-2026-33176 Active Support is a toolkit of support libraries and Ruby core extensions extracted from… Also affects ruby3.2-rails-8.1