GHSA-g9jg-w8vm-g96v
Medium · 4.6CVSS
4.6
EPSS
—
Published
Dec 31, 2025
CISA due date
—
The record
Trix has a stored XSS vulnerability through its attachment attribute
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| RubyGems | action_text-trix | 0 | 2.1.16 |
| npm | trix | 0 | 2.1.16 |
| Chainguard | ruby3.2-rails-8.1 | 0 | 8.1.2-r0 |
| Chainguard | ruby3.2-rails-8.1-compat | 0 | 8.1.1-r0 |
| Chainguard | ruby3.3-rails-8.1 | 0 | 8.1.1-r1 |
| Chainguard | ruby3.3-rails-8.1 | 0 | 8.1.2-r0 |
| Chainguard | ruby3.3-rails-8.1-compat | 0 | 8.1.1-r0 |
| Chainguard | ruby3.4-rails-8.1 | 0 | 8.1.2-r0 |
| Chainguard | ruby3.4-rails-8.1-compat | 0 | 8.1.1-r0 |
| Wolfi | ruby3.2-rails-8.1 | 0 | 8.1.2-r0 |
| Wolfi | ruby3.2-rails-8.1-compat | 0 | 8.1.1-r0 |
| Wolfi | ruby3.3-rails-8.1 | 0 | 8.1.1-r1 |
| Wolfi | ruby3.3-rails-8.1 | 0 | 8.1.2-r0 |
| Wolfi | ruby3.3-rails-8.1-compat | 0 | 8.1.1-r0 |
| Wolfi | ruby3.4-rails-8.1 | 0 | 8.1.2-r0 |
| Wolfi | ruby3.4-rails-8.1-compat | 0 | 8.1.1-r0 |
Related vulnerabilities
- GHSA-53p3-c7vp-4mcc Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop… Also affects action_text-trix
- GHSA-qmpg-8xg6-ph5q Trix has a Stored XSS vulnerability through serialized attributes Also affects action_text-trix
- CVE-2024-43368 The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious… Also affects trix
- CVE-2024-34341 Trix is a rich text editor. Also affects trix
- CVE-2026-33202 Active Storage allows users to attach cloud and local files in Rails applications. Also affects ruby3.2-rails-8.1
- CVE-2026-33170 Active Support is a toolkit of support libraries and Ruby core extensions extracted from… Also affects ruby3.2-rails-8.1
- CVE-2026-33173 Active Storage allows users to attach cloud and local files in Rails applications. Also affects ruby3.2-rails-8.1
- CVE-2026-33176 Active Support is a toolkit of support libraries and Ruby core extensions extracted from… Also affects ruby3.2-rails-8.1