Skip to content
OpenAdvisories

Package · RubyGems

action_text-trix

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 2.1
    CVE-2026-73427

    Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputControlle…

    basecamp trix ruby3.2-rails-8.1 ruby3.4-rails-8.1 Wolfi npm RubyGems