Skip to content

Commit d60ae3e

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@3540444 
1 parent 7428f2f commit d60ae3e

6 files changed

Lines changed: 326 additions & 0 deletions

‎advisories/_posts/2026-03-12-CVE-2026-73426.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-73426 (action_text-trix): Trix has a Stored XSS vulnerability through
4+
serialized attributes'
5+
comments: false
6+
categories:
7+
- action_text-trix
8+
advisory:
9+
gem: action_text-trix
10+
cve: 2026-73426
11+
ghsa: qmpg-8xg6-ph5q
12+
url: https://github.com/basecamp/trix/security/advisories/GHSA-qmpg-8xg6-ph5q
13+
title: Trix has a Stored XSS vulnerability through serialized attributes
14+
date: 2026-03-12
15+
description: |-
16+
### Impact
17+
18+
The Trix editor, in versions prior to 2.1.17, is vulnerable to XSS
19+
attacks when a `data-trix-serialized-attributes` attribute bypasses
20+
the DOMPurify sanitizer.
21+
22+
An attacker could craft HTML containing a `data-trix-serialized-attributes`
23+
attribute with a malicious payload that, when the content is rendered,
24+
could execute arbitrary JavaScript code within the context of the user's
25+
session, potentially leading to unauthorized actions being performed
26+
or sensitive information being disclosed.
27+
28+
### Patches
29+
30+
Update Recommendation: Users should upgrade to Trix editor
31+
version 2.1.17 or later.
32+
33+
### References
34+
35+
The XSS vulnerability was responsibly reported by Hackerone
36+
researcher [newbiefromcoma](https://hackerone.com/newbiefromcoma).
37+
cvss_v3: 4.6
38+
patched_versions:
39+
- ">= 2.1.17"
40+
related:
41+
url:
42+
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-73426
43+
- https://rubygems.org/gems/action_text-trix/versions/2.1.17
44+
- https://github.com/basecamp/trix/releases/tag/v2.1.17
45+
- https://github.com/basecamp/trix/pull/1282
46+
- https://github.com/basecamp/trix/commit/53197ab5a142e6b0b76127cb790726b274eaf1bc
47+
- https://hackerone.com/reports/3581911
48+
- https://github.com/basecamp/trix/security/advisories/GHSA-qmpg-8xg6-ph5q
49+
- https://github.com/advisories/GHSA-qmpg-8xg6-ph5q
50+
notes: |
51+
- cvss_v3 from GHSA
52+
- CVE is reserved, but not published.
53+
---

‎advisories/_posts/2026-03-26-CVE-2026-73428.md‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-73428 (action_text-trix): Stored XSS via HTMLParser attribute injection
4+
on paste'
5+
comments: false
6+
categories:
7+
- action_text-trix
8+
advisory:
9+
gem: action_text-trix
10+
cve: 2026-73428
11+
ghsa: 53g2-mvcc-q9x3
12+
url: https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3
13+
title: Stored XSS via HTMLParser attribute injection on paste
14+
date: 2026-03-26
15+
description: |-
16+
## Impact
17+
18+
The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS
19+
when crafted HTML is pasted into the editor. The HTMLParser processed
20+
a mock attachment, a <span> carrying an empty data-trix-attachment="{}".
21+
The empty attachment object caused the element to bypass attachment
22+
handling, so its data-trix-attributes were applied to a plain string
23+
piece. The pre-2.1.18 StringPiece.fromJSON accepted the href without
24+
validation, so an attacker-supplied javascript: URI was carried into
25+
the document model and emitted verbatim into the serialized HTML,
26+
executing when the content was rendered and clicked.
27+
28+
This is a stored XSS in any application that accepts untrusted rich
29+
text through Trix and renders the serialized output to other users.
30+
Applications that apply server-side HTML sanitization, such as the
31+
Rails built-in sanitizer, are additionally protected because the
32+
payload is neutralized on save.
33+
34+
This vulnerability shares its fix with GHSA-53p3-c7vp-4mcc.
35+
Both are resolved by the StringPiece.fromJSON sanitization added
36+
in 2.1.18. This advisory covers the paste and HTMLParser entry
37+
vector, while GHSA-53p3-c7vp-4mcc covers the drag-and-drop path
38+
through the fallback Level0InputController.
39+
40+
## References
41+
42+
The vulnerability was responsibly reported by HackerOne
43+
researcher newbiefromcoma.
44+
cvss_v3: 4.6
45+
patched_versions:
46+
- ">= 2.1.18"
47+
related:
48+
url:
49+
- https://nvd.nist.gov/vuln/detail/CVE-2026-73428
50+
- https://rubygems.org/gems/action_text-trix/versions/2.1.18
51+
- https://github.com/basecamp/trix/releases/tag/v2.1.18
52+
- https://github.com/basecamp/trix/pull/1293
53+
- https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c
54+
- https://github.com/advisories/GHSA-53p3-c7vp-4mcc
55+
- https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3
56+
- https://github.com/advisories/GHSA-53g2-mvcc-q9x3
57+
notes: |
58+
- cvss_v3 from GHSA URL.
59+
- date from gem releases page
60+
- Unnknown HackerOne number
61+
---

‎advisories/_posts/2026-03-29-CVE-2026-73427.md‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-73427 (action_text-trix): Trix is vulnerable to XSS through JSON
4+
deserialization bypass in drag-and-drop (Level0InputController)'
5+
comments: false
6+
categories:
7+
- action_text-trix
8+
advisory:
9+
gem: action_text-trix
10+
cve: 2026-73427
11+
ghsa: 53p3-c7vp-4mcc
12+
url: https://github.com/basecamp/trix/security/advisories/GHSA-53p3-c7vp-4mcc
13+
title: Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop
14+
(Level0InputController)
15+
date: 2026-03-29
16+
description: |-
17+
### Impact
18+
19+
The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS
20+
when a crafted `application/x-trix-document` JSON payload is dropped
21+
into the editor in environments using the fallback Level0InputController
22+
(e.g., embedded WebViews lacking Input Events Level 2 support).
23+
24+
The `StringPiece.fromJSON` method trusted `href` attributes from the
25+
JSON payload without sanitization. An attacker could craft a draggable
26+
element containing a `javascript:` URI in the href attribute that,
27+
when dropped into a vulnerable editor, would bypass DOMPurify
28+
sanitization and inject executable JavaScript into the DOM.
29+
30+
Exploitation requires a specific environment (Level0InputController
31+
fallback) and social engineering (victim must drag and drop
32+
attacker-controlled content into the editor). Applications using
33+
server-side HTML sanitization (such as Rails' built-in sanitizer)
34+
are additionally protected, as the payload is neutralized on save.
35+
36+
### Patches
37+
38+
Update Recommendation: Users should upgrade to Trix editor
39+
version 2.1.18 or later.
40+
41+
### References
42+
43+
The XSS vulnerability was responsibly reported by Hackerone
44+
researcher [newbiefromcoma](https://hackerone.com/newbiefromcoma).
45+
cvss_v4: 2.1
46+
patched_versions:
47+
- ">= 2.1.18"
48+
related:
49+
url:
50+
- https://nvd.nist.gov/vuln/detail/CVE-2026-73427
51+
- https://rubygems.org/gems/action_text-trix/versions/2.1.18
52+
- https://github.com/basecamp/trix/releases/tag/v2.1.18
53+
- https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c
54+
- https://github.com/basecamp/trix/security/advisories/GHSA-53p3-c7vp-4mcc
55+
- https://github.com/advisories/GHSA-53p3-c7vp-4mcc
56+
notes: "- cvss_v4 from GHSA and nvd.nist.gov URLs.\n"
57+
---

‎advisories/_posts/2026-07-15-CVE-2026-73490.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-73490 (loofah): SVG `href` attribute bypasses local-reference restriction
4+
in Loofah'
5+
comments: false
6+
categories:
7+
- loofah
8+
advisory:
9+
gem: loofah
10+
ghsa: 9wjq-cp2p-hrgf
11+
cve: 2026-73490
12+
url: https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf
13+
title: SVG `href` attribute bypasses local-reference restriction in Loofah
14+
date: 2026-07-15
15+
description: |-
16+
## Summary
17+
18+
Loofah's HTML5 sanitizer restricted only the xlink:href attribute on
19+
certain SVG elements to local, same-document references. Browsers
20+
also accept a plain href attribute as an alternative to the deprecated
21+
xlink:href per the SVG 2 spec, but Loofah did not apply the same
22+
restriction to it, allowing those elements to reference arbitrary
23+
external documents.
24+
25+
## Impact
26+
27+
SVG <use> can load and render external SVG content by reference. If
28+
the referenced external SVG is same-origin and contains scripts or
29+
other dangerous content, it could execute in the context of the
30+
sanitized document. <feImage> can load external images, which can be
31+
used for tracking. Modern browsers restrict cross-origin <use>
32+
fetches, which limits but does not eliminate the risk.
33+
34+
Applications that sanitize user-supplied SVG (directly, or as part
35+
of HTML) with Loofah's default allowlist are affected.
36+
37+
## Credit
38+
39+
Found by the maintainer, Mike Dalessio, during a security audit.
40+
cvss_v3: 4.7
41+
patched_versions:
42+
- ">= 2.25.2"
43+
related:
44+
url:
45+
- https://nvd.nist.gov/vuln/detail/CVE-2026-73490
46+
- https://rubygems.org/gems/loofah/versions/2.25.2
47+
- https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md#2252--2026-07-15
48+
- https://github.com/flavorjones/loofah/commit/20867b9be689521887364b74822c41ef830523c9
49+
- https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf
50+
notes: "- cvss_v3 from GHSA and nvd.nist.gov URLs.\n"
51+
---

‎advisories/_posts/2026-07-15-CVE-2026-73491.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-73491 (loofah): Loofah `allowed_uri?` does not detect `javascript:`
4+
URIs split by named whitespace character references'
5+
comments: false
6+
categories:
7+
- loofah
8+
advisory:
9+
gem: loofah
10+
cve: 2026-73491
11+
ghsa: 8whx-365g-h9vv
12+
url: https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv
13+
title: Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace
14+
character references
15+
date: 2026-07-15
16+
description: |-
17+
## Summary
18+
19+
Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript:
20+
URIs when the scheme is split or prefixed by the HTML5 named character
21+
references &Tab; (tab) or &NewLine; (line feed).
22+
23+
This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled
24+
the equivalent numeric character references (&#9;, &#10;, &#13;) but
25+
did not cover the named forms.
26+
cvss_v4: 2.3
27+
unaffected_versions:
28+
- "< 2.25.0"
29+
patched_versions:
30+
- ">= 2.25.2"
31+
related:
32+
url:
33+
- https://nvd.nist.gov/vuln/detail/CVE-2026-73491
34+
- https://rubygems.org/gems/loofah/versions/2.25.2
35+
- https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md#2252--2026-07-15
36+
- https://github.com/flavorjones/loofah/commit/5e91af861e3cdab47b91dd0b81f3afdfd13a5e19
37+
- https://github.com/advisories/GHSA-46fp-8f5p-pf2m
38+
- https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv
39+
- https://github.com/advisories/GHSA-8whx-365g-h9vv
40+
notes: "- cvss_v4 from GHSA and nvd.nist.gov URLs.\n"
41+
---

‎advisories/_posts/2026-07-15-CVE-2026-73648.md‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-73648 (rails-html-sanitizer): Possible XSS vulnerability with certain
4+
configurations of rails-html-sanitizer'
5+
comments: false
6+
categories:
7+
- rails-html-sanitizer
8+
- rails
9+
advisory:
10+
gem: rails-html-sanitizer
11+
framework: rails
12+
cve: 2026-73648
13+
ghsa: cj75-f6xr-r4g7
14+
url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cj75-f6xr-r4g7
15+
title: Possible XSS vulnerability with certain configurations of rails-html-sanitizer
16+
date: 2026-07-15
17+
description: |-
18+
## Summary
19+
20+
There is a possible cross-site scripting vulnerability in
21+
rails-html-sanitizer when the sanitizer is configured to allow an
22+
SVG reference element such as <use>.
23+
See related GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference
24+
logic rails-html-sanitizer mirrors.
25+
26+
## Impact
27+
28+
`Rails::HTML::PermitScrubber` restricts SVG reference elements in the
29+
`SVG_ALLOW_LOCAL_HREF` collection to local, same-document references,
30+
but that restriction covered only the `xlink:href` attribute. Browsers
31+
also accept a plain `href` attribute per the SVG 2 spec, and it was
32+
not restricted, so those elements could reference arbitrary external
33+
documents. SVG `<use>` can load and render external SVG content by
34+
reference, and if the referenced document is same-origin and contains
35+
scripts, it could execute in the context of the sanitized document.
36+
`<feImage>` can load external images, which can be used for tracking.
37+
38+
Applications are impacted only when the allowed tags are overridden
39+
to include one of these SVG reference elements, for example `<use>`
40+
or `<feImage>`. The default allowed tags do not include these SVG
41+
elements, so applications using the default configuration are not affected.
42+
43+
## Credit
44+
45+
Found by maintainer Mike Dalessio during a security audit.
46+
cvss_v4: 5.1
47+
unaffected_versions:
48+
- "< 1.0.3"
49+
patched_versions:
50+
- ">= 1.7.1"
51+
related:
52+
url:
53+
- https://nvd.nist.gov/vuln/detail/CVE-2026-73648
54+
- https://rubygems.org/gems/rails-html-sanitizer/versions/1.7.1
55+
- https://github.com/rails/rails-html-sanitizer/releases/tag/v1.7.1
56+
- https://github.com/rails/rails-html-sanitizer/blob/main/CHANGELOG.md#v171--2026-07-15
57+
- https://github.com/rails/rails-html-sanitizer/commit/74dcb8053e6da9921246ce71b06ad9fd65b19586
58+
- https://discuss.rubyonrails.org/t/ghsa-cj75-f6xr-r4g7-possible-xss-vulnerability-with-certain-configurations-of-rails-html-sanitizer/91359#post_1
59+
- https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf
60+
- https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cj75-f6xr-r4g7
61+
- https://github.com/advisories/GHSA-cj75-f6xr-r4g7
62+
notes: "- cvss_v4 in GHSA and nvd.nist.gov URLs.\n"
63+
---

0 commit comments

Comments
 (0)