{"action":"Upgrade action_text-trix to 2.1.16 or later.","affected":[{"fixed":"2.1.16","introduced":"0"}],"component":"action_text-trix","cve_ids":[],"ecosystem":"RubyGems","exploited":false,"fixed_versions":["2.1.16"],"ghsa_id":"GHSA-g9jg-w8vm-g96v","id":"tcs_01M5KEK9NCS2A3DR4A4PAPXAVH","modified_at":"2026-09-10T03:50:31.999539271Z","published_at":"2025-12-31T22:07:25Z","references":["https://osv.dev/vulnerability/GHSA-g9jg-w8vm-g96v","https://github.com/basecamp/trix/security/advisories/GHSA-g9jg-w8vm-g96v","https://github.com/basecamp/trix/commit/73c20cf03ab2b56c0ef9c9b1aaf63f2de44f4010","https://github.com/basecamp/trix","https://github.com/basecamp/trix/releases/tag/v2.1.16","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/action_text-trix/GHSA-g9jg-w8vm-g96v.yml"],"severity":{"label":"medium","score":4.6},"sources":[{"source":"osv","source_id":"GHSA-g9jg-w8vm-g96v#RubyGems/action_text-trix","url":"https://osv.dev/vulnerability/GHSA-g9jg-w8vm-g96v"}],"summary":"Trix has a stored XSS vulnerability through its attachment attribute"}