Backport CVE-2024-43368 to trix v1 and update advisory

[tagliala]

Hello,

is there by any chance the possibility to backport the fix for CVE-2024-43368 to v1 and release a new version?

Follow up:

• Backport CVE-2024-34341 to trix v1 #1150
• Backport CVE-2024-34341 fixes to v1.3 #1153

[ha4gu]

trix 1.3.3 and 1.3.4 are released, and 1.3.3 seems to be backported the fix of CVE-2024-43368.
Thanks for the update.

[tagliala]

Thanks for the heads-up,

It appears that GHSA-qm2q-9f3q-2vcv needs an update to consider trix >= 1.3.3 safe, just like it happened with the previous CVE reported

$ yarn list --pattern trix
yarn list v1.22.22
└─ trix@1.3.4

$ yarn audit
yarn audit v1.22.22
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ moderate      │ Trix has a cross-site Scripting vulnerability on copy &      │
│               │ paste                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ trix                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.1.4                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ trix                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ trix                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1098590                     │
└───────────────┴──────────────────────────────────────────────────────────────┘

[tagliala]

Hello,

at the moment I'm writing, the advisory has not been updated yet

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ moderate      │ Trix has a cross-site Scripting vulnerability on copy &      │
│               │ paste                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ trix                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.1.4                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ trix                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ trix                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1098590                     │
└───────────────┴──────────────────────────────────────────────────────────────┘