From 8aff9254d535d48a26f51932a9237d341b141731 Mon Sep 17 00:00:00 2001 From: Igor Zubkov Date: Sun, 30 Aug 2026 16:01:48 +0200 Subject: [PATCH 1/2] GHSA-p452-6f7x-vcqx --- blog/_posts/2026-08-30-GHSA-p452-6f7x-vcqx.markdown | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 blog/_posts/2026-08-30-GHSA-p452-6f7x-vcqx.markdown diff --git a/blog/_posts/2026-08-30-GHSA-p452-6f7x-vcqx.markdown b/blog/_posts/2026-08-30-GHSA-p452-6f7x-vcqx.markdown new file mode 100644 index 0000000..e69de29 From fc803ad5229c05193f7a45a525efc5ffbd211a95 Mon Sep 17 00:00:00 2001 From: Igor Zubkov Date: Sun, 30 Aug 2026 16:09:28 +0200 Subject: [PATCH 2/2] Update --- .../2026-08-30-GHSA-p452-6f7x-vcqx.markdown | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/blog/_posts/2026-08-30-GHSA-p452-6f7x-vcqx.markdown b/blog/_posts/2026-08-30-GHSA-p452-6f7x-vcqx.markdown index e69de29..d0c8522 100644 --- a/blog/_posts/2026-08-30-GHSA-p452-6f7x-vcqx.markdown +++ b/blog/_posts/2026-08-30-GHSA-p452-6f7x-vcqx.markdown @@ -0,0 +1,24 @@ +--- +layout: post +title: "XSS in via notice backtrace file path (GHSA-p452-6f7x-vcqx)" +date: 2026-08-31 00:00:00 +0200 +category: security +--- + +Hello, + +[@saidM](https://github.com/saidM) found XSS via notice backtrace file path. + +This advisory is assigned [GHSA-p452-6f7x-vcqx](https://github.com/errbit/errbit/security/advisories/GHSA-p452-6f7x-vcqx). + +CVE is pending. + +Affected code: + +```erb +# app/views/notices/_backtrace_line.html.erb + +<%= raw line.decorated_path %> +``` + +Fix released in Errbit version: v0.11.5.