p PatchFirst

GHSA-g9jg-w8vm-g96v

GHSA-g9jg-w8vm-g96v · Trix has a stored XSS vulnerability through its attachment attribute

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

### Impact The Trix editor, in versions prior to 2.1.16, is vulnerable to XSS attacks through attachment payloads. An attacker could inject malicious code into a data-trix-attachment attribute that, when rendered as HTML and clicked on, could execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. ### Patches Update Recommendation: Users should upgrade to Trix editor version 2.1.16 or later. ### Resources The XSS vulnerability was reported by HackerOne researcher [michaelcheers](https://hackerone.com/michaelcheers?type=user).

CVSS 4.6 · Mittel · Korrektur verfügbar

Veröffentlicht
Aktualisiert

Technologie-Stack: node

Betroffene Produkte und Versionen

  • trix npm

    Betroffene Versionsbereiche
    • SEMVER: < 2.1.16

    Auf 2.1.16 aktualisieren

  • action_text-trix RubyGems

    Softwareversionen
    • 0.0.1
    • 2.1.15
    Betroffene Versionsbereiche
    • ECOSYSTEM: < 2.1.16

    Auf 2.1.16 aktualisieren

Originalquellen

Prüfen Sie Ihren Server →