Description
The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor.
Recommendation
Update the trix package to the latest compatible version. Followings are version details:
Affected version(s): **>= 0.9.0, < 1.3.2 >= 2.0.0, < 2.1.1** Patched version(s): **1.3.2 2.1.1**
References
Could your website be exposed too?
SmartScanner can check your website for Trix Editor Arbitrary Code Execution Vulnerability and gives you actionable findings to investigate.
Start a free scanRelated Issues
- dom-iterator code execution vulnerability - CVE-2024-21541
- JSONPath Plus Remote Code Execution (RCE) Vulnerability - CVE-2024-21534
- Clipboard feature vulnerability allowing to inject arbitrary HTML into the editor using paste functionality - CVE-2021-32809
- webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundle - CVE-2024-43373
You might also like:
See something that needs correcting? Let us knowUpdated June 03, 2024