CVE-2024-32464: ActionText ContentAttachment can Contain Unsanitized HTML
Summary
CVE-2024-32464: ActionText ContentAttachment can Contain Unsanitized HTML. Affects actiontext across 2 version ranges.
>= 7.1.0, < 7.1.3.4
>= 7.2.0.beta1, < 7.2.0.beta2
Fixed in 7.1.3.4 or 7.2.0.beta2, depending on the release line you run. How to fix ↓
Also tracked for
- rails · Bitnami
The same CVE-2024-32464 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ActionText is a RubyGem that provides a rich text editing experience for web applications. It allows users to create and edit content with features like formatting, embedding images, and attaching files. The ContentAttachment class in ActionText is responsible for handling file attachments within the rich text editor. However, versions of ActionText starting from 7.1.0 up to 7.1.3.4 are vulnerable to a cross-site scripting (XSS) issue. This vulnerability allows attackers to inject unsanitized HTML code into the Trix editor, potentially leading to malicious actions.
Vulnerability Detail
The vulnerability arises from the fact that instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag can contain unsanitized HTML. This means that if an attacker can manipulate the content of the attachment, they can inject arbitrary HTML code, including JavaScript, into the Trix editor. When other users view or interact with the affected content, the injected code will execute in their browsers, potentially leading to XSS attacks. The impact of this vulnerability can range from stealing sensitive user information to performing unauthorized actions on behalf of the user.
How To Fix
Latest published version: 8.1.4 as of 23 Oct 2026
gem install actiontext -v 8.1.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 7.1.0, < 7.1.3.47.1.3.4gem install actiontext -v 7.1.3.4 -
>= 7.2.0.beta1, < 7.2.0.beta27.2.0.beta2gem install actiontext -v 7.2.0.beta2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are unable to upgrade to the fixed version immediately, you can apply the provided patch for the 7.1 series. The patch file 'action_text_content_attachment_xss_7_1_stable.patch' can be downloaded from the source link provided in the advisory. To apply the patch, navigate to your application's root directory and run the following command: git apply path/to/patch/file. After applying the patch, restart your application to mitigate the vulnerability.
Conclusion
In conclusion, ActionText versions 7.1.0 to 7.1.3.4 are vulnerable to a cross-site scripting (XSS) issue that allows attackers to inject unsanitized HTML code into the Trix editor. To mitigate this vulnerability, it is recommended to upgrade to version 7.1.3.4 or apply the provided patch. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for actiontext →
FAQ
Versions of ActionText starting from 7.1.0 up to 7.1.3.4 are affected by this vulnerability.
This vulnerability can lead to potential cross-site scripting (XSS) attacks within the Trix editor. Attackers can inject unsanitized HTML code, including JavaScript, which may result in stealing user information or performing unauthorized actions.
To fix this vulnerability, upgrade to version 7.1.3.4 of the ActionText gem. Alternatively, you can apply the provided patch for the 7.1 series if an immediate upgrade is not possible.
Yes, if you cannot upgrade immediately, you can apply the provided patch for the 7.1 series. Instructions for applying the patch can be found in the advisory.
This vulnerability was reported by ooooooo_q and acknowledged by the Ruby on Rails security team.
References
Related vulnerabilities
Recent vulnerabilities recorded for actiontext.
