| Package | Affected versions | Patched versions |
|---|---|---|
| actiontext | ≥ 7.1.0, < 7.1.3.4≥ 7.2.0.beta1, < 7.2.0.beta2 | 7.1.3.47.2.0.beta2 |
| rails | = 7.2.0≥ 7.1.0, < 7.1.3.4 | 7.1.3.4 |
Instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag could potentially contain unsanitized HTML.
This has been assigned the CVE identifier CVE-2024-32464.
Versions Affected: >= 7.1.0 Not affected: < 7.1.0 Fixed Versions: 7.1.3.4
This could lead to a potential cross site scripting issue within the Trix editor.
The fixed releases are available at the normal locations.
N/A
To aid users who aren't able to upgrade immediately we have provided patches for the supported release series in accordance with our maintenance policy regarding security issues. They are in git-am format and consist of a single changeset.
Thank you ooooooo_q for reporting this!
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free