GHSA-qmpg-8xg6-ph5q (action_text-trix): Trix has a Stored XSS vulnerability through serialized attributes
    
    
     ...

The RubyLA blog offers insights, tutorials, and community updates for Ruby developers in Los Angeles and beyond. Developers can explore Ruby language features, web development frameworks, and best practices for building Ruby applications. Additionally, the blog covers Ruby meetups, events, and job opportunities in the Los Angeles area, fostering collaboration and networking within the local Ruby community.

RUBYLAND

A stored XSS vulnerability (CVE GHSA-qmpg-8xg6-ph5q) has been disclosed in the Trix editor (used by Rails Action Text) affecting versions prior to 2.1.17. Attackers can craft HTML with a malicious `data-trix-serialized-attributes` attribute that bypasses DOMPurify sanitization, enabling arbitrary JavaScript execution in the victim's session. The fix is to upgrade to Trix version 2.1.17 or later. The vulnerability was responsibly reported via HackerOne and carries a CVSS v3 score of 4.6 (Medium).