@mikelolasagasti found XSS in the comment notification email.

This advisory is assigned GHSA-623h-px8r-9643.

CVE is pending.

Affected code:

# app/views/mailer/comment_notification.html.erb

<%= @comment.body.to_s.gsub("\n", "<br>").html_safe %>

Fixed version:

<%= simple_format(@comment.body) %>

Fix in PR: https://github.com/errbit/errbit/pull/3094

Fix released in Errbit version: v0.11.5.

Workaround: Make sure that you are using an email client that properly sanitizes the HTML body of the email.

But, before we dive into the details, I want to make a quick announcement.

I am Igor (Ihor) Zubkov, the new maintainer of Errbit.

I don’t plan to change the direction of the project. I will continue to maintain Errbit as a self-hosted error tracking solution, and I will do my best to keep it up-to-date with the latest technologies and security patches.

Now, let’s talk about the new features and improvements in version v0.11.0.

The new Errbit release is faster, more secure, and more modern than ever before.

Short changelog:

1. Ruby 4.0.5.
2. RubyGems 4.0.13 and Bundler 4.0.13.
3. Rails 8.1.3.
4. We don’t support JRuby anymore.
5. We removed Gtalk and HipChat notification services. Both services are dead.
6. Removed support for MongoDB 4.0, 4.2, 4.4, 5.0 and 6.0. We added support for MongoDB 8.2.
7. Alpine docker image removed. We don’t want to support two docker builds.
8. Enable strict locals for ActionView.
9. Replace Fabrication with FactoryBot.
10. Replace outdated ri_cal gem with icalendar.
11. Replace outdated rushover gem with pushover2.
12. Migrate app/views/**/*.haml.erb to app/views/**/*.html.erb.
13. Add GitHub Action for Bundler Audit and Brakeman.
14. Integrate Trivy for container image scanning.
15. Deprecated sucker_punch gem was removed. Active Job now uses the async queue adapter instead.
16. Started integrating the pundit gem. From now on, only admin users can see all users.
17. Add mailer previews.
18. Fix API JSON serialization for Mongoid documents (PR #2597) by @elektronaut.
19. Fix ResolvedProblemClearer. Compact can fail (second case for #1551). PR #1905.

This is also the last release that supports MongoDB.

Our plans for the future include:

1. Migrate to an SQL database (ActiveRecord). Ref: #2832.
2. Use Errbit as an MCP server. Ref: #2873.
3. Add OIDC (aka OpenID Connect) support. Ref: #2634.

We are also looking for contributors to help us with these plans. If you are interested in contributing, please check out our GitHub Issues.