RubyGems/action_text-trix: medium 4.6

Trix has a stored XSS vulnerability through its attachment attribute

Action: Upgrade action_text-trix to 2.1.16 or later.

bundle update action_text-trix

Affected

Fixed versions

Sources

• osv: GHSA-g9jg-w8vm-g96v#RubyGems/action_text-trix
• https://github.com/basecamp/trix/security/advisories/GHSA-g9jg-w8vm-g96v
• https://github.com/basecamp/trix/commit/73c20cf03ab2b56c0ef9c9b1aaf63f2de44f4010
• https://github.com/basecamp/trix
• https://github.com/basecamp/trix/releases/tag/v2.1.16
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/action_text-trix/GHSA-g9jg-w8vm-g96v.yml

published 2025-12-31T22:07:25Z · modified 2026-09-10T03:50:31.999539271Z · JSON