npm/trix: medium 4.6
Trix has a stored XSS vulnerability through its attachment attribute
Action: Upgrade trix to 2.1.16 or later.
npm i trix@2.1.16Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.16 | - |
Fixed versions
| 2.1.16 |
Sources
- osv: GHSA-g9jg-w8vm-g96v
- https://github.com/basecamp/trix/security/advisories/GHSA-g9jg-w8vm-g96v
- https://github.com/basecamp/trix/commit/73c20cf03ab2b56c0ef9c9b1aaf63f2de44f4010
- https://github.com/basecamp/trix
- https://github.com/basecamp/trix/releases/tag/v2.1.16
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/action_text-trix/GHSA-g9jg-w8vm-g96v.yml
published · modified · JSON