Skip to content
OpenAdvisories

Vendor

basecamp

11 known vulnerabilities.

Products

trix 8 google_sign_in 2 once-campfire 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 3.1
    CVE-2026-100355

    Campfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guard

    Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. `RestrictedHTTP::PrivateNetworkGuard` relied on Ruby's `IPAddr#private? `` IPAddr#loop…

    basecamp once-campfire
  • Low 2.1
    CVE-2026-73427

    Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputControlle…

    basecamp trix trix action_text-trix npm RubyGems
  • Low 2.0
    CVE-2025-46812

    Trix vulnerable to Cross-site Scripting on copy & paste

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.15 are vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary Java…

    basecamp trix trix npm