GHSA-qmpg-8xg6-ph5q
Medium · 4.6CVSS
4.6
EPSS
—
Published
Mar 12, 2026
CISA due date
—
The record
Trix has a Stored XSS vulnerability through serialized attributes
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| RubyGems | action_text-trix | 0 | 2.1.17 |
| npm | trix | 0 | 2.1.17 |
| Chainguard | ruby3.3-rails-8.1 | 0 | 8.1.2.1-r0 |
| Chainguard | ruby3.4-rails-8.1 | 0 | 8.1.2.1-r0 |
| Chainguard | ruby4.0-rails-8.1 | 0 | 8.1.2.1-r0 |
| Wolfi | ruby3.3-rails-8.1 | 0 | 8.1.2.1-r0 |
| Wolfi | ruby3.4-rails-8.1 | 0 | 8.1.2.1-r0 |
| Wolfi | ruby4.0-rails-8.1 | 0 | 8.1.2.1-r0 |
Related vulnerabilities
- GHSA-53p3-c7vp-4mcc Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop… Also affects action_text-trix
- GHSA-g9jg-w8vm-g96v Trix has a stored XSS vulnerability through its attachment attribute Also affects action_text-trix
- CVE-2024-43368 The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious… Also affects trix
- CVE-2024-34341 Trix is a rich text editor. Also affects trix
- CVE-2026-33210 Ruby JSON is a JSON implementation for Ruby. Also affects ruby3.3-rails-8.1
- CVE-2026-25500 Rack is a modular Ruby web server interface. Also affects ruby3.3-rails-8.1
- CVE-2026-22860 Rack is a modular Ruby web server interface. Also affects ruby3.3-rails-8.1
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79