actiontext

Ruby on Rails

View on Rubygems

View on Github

Activity

Latest release: 1mo ago
Total releases: 153
Cadence: ~daily
Last 12 months: 16

Reach

Stars: 58.7k

Details

License: MIT
First release: Jan 18, 2019

Releases

Version	Released
`8.0.5.1` patch	Jul 29, 2026
`7.2.3.2` patch	Jul 29, 2026
`8.1.3.1` patch	Jul 29, 2026
`8.1.3` patch	Mar 24, 2026
`8.0.5` patch	Mar 24, 2026
`8.1.2.1` patch	Mar 23, 2026
`8.0.4.1` patch	Mar 23, 2026
`7.2.3.1` patch	Mar 23, 2026
`8.1.2` patch	Jan 08, 2026
`8.1.1` patch	Oct 28, 2025
`8.0.4` patch	Oct 28, 2025
`7.2.3` patch	Oct 28, 2025
`7.1.6` patch	Oct 28, 2025
`7.0.10` patch	Oct 28, 2025
`8.1.0` minor	Oct 22, 2025
`8.1.0.rc1` pre	Oct 15, 2025
`8.0.3` patch	Sep 22, 2025
`8.1.0.beta1` pre	Sep 04, 2025
`8.0.2.1` patch	Aug 13, 2025
`7.2.2.2` patch	Aug 13, 2025
`7.1.5.2` patch	Aug 13, 2025
`8.0.2` patch	Mar 12, 2025
`8.0.1` patch	Dec 13, 2024
`7.2.2.1` patch	Dec 10, 2024
`8.0.0.1` patch	Dec 10, 2024
`7.1.5.1` patch	Dec 10, 2024
`7.0.8.7` patch	Dec 10, 2024
`8.0.0` major	Nov 07, 2024
`7.2.2` patch	Oct 31, 2024
`7.1.5` patch	Oct 31, 2024
`8.0.0.rc2` pre	Oct 30, 2024
`7.2.1.2` patch	Oct 23, 2024
`6.1.7.10` patch	Oct 23, 2024
`7.1.4.2` patch	Oct 23, 2024
`7.0.8.6` patch	Oct 23, 2024
`8.0.0.rc1` pre	Oct 19, 2024
`7.2.1.1` patch	Oct 15, 2024
`7.1.4.1` patch	Oct 15, 2024
`7.0.8.5` patch	Oct 15, 2024
`6.1.7.9` patch	Oct 15, 2024
`8.0.0.beta1` pre	Sep 26, 2024
`7.2.1` patch 1 CVE	Aug 22, 2024
`7.1.4` patch 1 CVE	Aug 22, 2024
`7.2.0` minor 1 CVE	Aug 09, 2024
`7.2.0.rc1` pre	Aug 06, 2024
`7.2.0.beta3` pre	Jul 11, 2024
`7.1.3.4` patch 1 CVE	Jun 04, 2024
`7.2.0.beta2` pre	Jun 04, 2024
`7.0.8.4` patch 1 CVE	Jun 04, 2024
`6.1.7.8` patch 1 CVE	Jun 04, 2024

1–50 of 153

Repository

rails/rails

Forks: 22.3k
Open issues: 487
Language: Ruby
: 6.0/ 10

rails
mvc
html
activerecord
activejob
ruby

Dependencies (6)

Depends on

8.0.5.1

Used by

Supply-chain exposure

16 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (3)

CVE-2024-47888 GHSA-wwhv-wxv9-rpgw BIT-rails-2024-47888 Oct 15, 2024

Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text

Medium
Network Low None None

There is a possible ReDoS vulnerability in the plain_text_for_blockquote_node helper in Action Text. This vulnerability has been assigned the CVE identifier CVE-2024-47888.

Impact

Carefully crafted text can cause the plain_text_for_blockquote_node helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately.

Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Releases

The fixed releases are available at the normal locations.

Workarounds

Users can avoid calling plain_text_for_blockquote_node or upgrade to Ruby 3.2

Credits

Thanks to ooooooo_q for the report!

Affected versions

6.0.06.0.16.0.1.rc16.0.26.0.2.16.0.2.26.0.2.rc16.0.2.rc26.0.36.0.3.16.0.3.26.0.3.3

+ 83 more Show less

6.0.3.46.0.3.56.0.3.66.0.3.76.0.3.rc16.0.46.0.4.16.0.4.26.0.4.36.0.4.46.0.4.56.0.4.66.0.4.76.0.4.86.0.56.0.5.16.0.66.0.6.16.1.06.1.0.rc16.1.0.rc26.1.16.1.26.1.2.16.1.36.1.3.16.1.3.26.1.46.1.4.16.1.4.26.1.4.36.1.4.46.1.4.56.1.4.66.1.4.76.1.56.1.5.16.1.66.1.6.16.1.76.1.7.16.1.7.26.1.7.36.1.7.46.1.7.56.1.7.66.1.7.76.1.7.87.0.07.0.17.0.27.0.2.17.0.2.27.0.2.37.0.2.47.0.37.0.3.17.0.47.0.4.17.0.4.27.0.4.37.0.57.0.5.17.0.67.0.77.0.7.17.0.7.27.0.87.0.8.17.0.8.27.0.8.37.0.8.47.1.07.1.17.1.27.1.37.1.3.17.1.3.27.1.3.37.1.3.47.1.47.2.07.2.1

Fixed in

6.1.7.97.0.8.57.1.4.17.2.1.1

References

https://github.com/rails/rails/security/advisories/GHSA-wwhv-wxv9-rpgw
https://github.com/rails/rails
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actiontext/CVE-2024-47888.yml

Updated Dec 02, 2024 · Source: OSV.dev
CVE-2024-32464 GHSA-prjp-h48f-jgf6 BIT-rails-2024-32464 Jun 04, 2024

ActionText ContentAttachment can Contain Unsanitized HTML

Medium
Network Low None

Instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag could potentially contain unsanitized HTML.

This has been assigned the CVE identifier CVE-2024-32464.

Versions Affected: >= 7.1.0 Not affected: < 7.1.0 Fixed Versions: 7.1.3.4

Impact

This could lead to a potential cross site scripting issue within the Trix editor.

Releases

The fixed releases are available at the normal locations.

Workarounds

N/A

Patches

To aid users who aren't able to upgrade immediately we have provided patches for the supported release series in accordance with our maintenance policy regarding security issues. They are in git-am format and consist of a single changeset.

action_text_content_attachment_xss_7_1_stable.patch - Patch for 7.1 series

Credits

Thank you ooooooo_q for reporting this!

Affected versions

7.1.07.1.17.1.27.1.37.1.3.17.1.3.27.1.3.37.2.0.beta1

Fixed in

7.1.3.47.2.0.beta2

References

https://github.com/rails/rails/security/advisories/GHSA-prjp-h48f-jgf6
https://nvd.nist.gov/vuln/detail/CVE-2024-32464
https://github.com/rails/rails/commit/e215bf3360e6dfe1497c1503a495e384ed6b0995
https://github.com/rails/rails
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actiontext/CVE-2024-32464.yml

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-34341 GHSA-qjqp-xr96-cj99 May 07, 2024

Trix Editor Arbitrary Code Execution Vulnerability

5.4 / 10
Medium
Network Low None Required Unchanged Low Low None

The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application.

Vulnerable Versions:

1.x series up to and including 1.3.1

2.x series up to and including 2.1.0

Fixed Versions:

v1.3.2

v2.1.1

Vector:

Bug 1: When copying content manipulated by a script, such as:

document.addEventListener('copy', function(e){ e.clipboardData.setData('text/html', '<div><noscript><div class="123</noscript>456<img src=1 onerror=alert(1)//"></div></noscript></div>'); e.preventDefault(); });

and pasting into the Trix editor, the script within the content is executed.

Bug 2: Similar execution occurs with content structured as:

document.write(`copy<div data-trix-attachment="{"contentType":"text/html","content":"<img src=1 onerror=alert(101)>HELLO123"}"></div>me`);

Impact:

An attacker could exploit these vulnerabilities to execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed.

Remediation:

Update Recommendation: Users should upgrade to Trix editor version 2.1.1 or later, which incorporates proper sanitization of input from copied content.

CSP Enhancement: Additionally, enhancing the Content Security Policy (CSP) to disallow inline scripts can significantly mitigate the risk of such vulnerabilities. Set CSP policies such as script-src 'self' to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using script-src-elem.

References:

https://github.com/basecamp/trix/releases/tag/v2.1.1

https://github.com/basecamp/trix/pull/1147

https://github.com/basecamp/trix/pull/1149

https://github.com/basecamp/trix/pull/1153

Credit: These issues were reported by security researchers loknop and pinpie.

Affected versions

7.0.07.0.0.alpha17.0.0.alpha27.0.0.rc17.0.0.rc27.0.0.rc37.0.17.0.27.0.2.17.0.2.27.0.2.37.0.2.4

+ 24 more Show less

7.0.37.0.3.17.0.47.0.4.17.0.4.27.0.4.37.0.57.0.5.17.0.67.0.77.0.7.17.0.7.27.0.87.0.8.17.0.8.27.1.07.1.0.beta17.1.0.rc17.1.0.rc27.1.17.1.27.1.37.1.3.17.1.3.2

Fixed in

7.0.8.37.1.3.3

References

https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99
https://nvd.nist.gov/vuln/detail/CVE-2024-34341
https://github.com/basecamp/trix/pull/1147
https://github.com/basecamp/trix/pull/1149
https://github.com/basecamp/trix/commit/1a5c68a14d48421fc368e30026f4a7918028b7ad
https://github.com/basecamp/trix/commit/841ff19b53f349915100bca8fcb488214ff93554

Updated Feb 04, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 2
minor 4
patch 118
pre 28

153 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More