Description
The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in place for https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99. In https://github.com/basecamp/trix/pull/1149, we added sanitation for Trix attachments with a text/html content type.
Recommendation
Update the trix package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.1.4
- Patched version(s): 2.1.4
References
Could your website be exposed too?
SmartScanner can check your website for Trix has a cross-site Scripting vulnerability on copy & paste and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability - CVE-2024-43407
- Trix vulnerable to Cross-site Scripting on copy & paste - CVE-2025-46812
- vue-i18n has cross-site scripting vulnerability with prototype pollution - CVE-2024-52809
- vue-i18n has cross-site scripting vulnerability with prototype pollution - vue-i18n - CVE-2024-52809
You might also like:
See something that needs correcting? Let us knowUpdated August 15, 2024