Trix has a Stored XSS vulnerability through serialized attributes

Description

The Trix editor, in versions prior to 2.1.17, is vulnerable to XSS attacks when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer.

Recommendation

Update the trix package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.1.17
• Patched version(s): 2.1.17

References

• GHSA-qmpg-8xg6-ph5q
• CWE-79
• OWASP 2021-A3

Related Issues

• Trix has a stored XSS vulnerability through its attachment attribute - Vulnerability
• React Router has XSS Vulnerability - CVE-2025-59057
• vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - CVE-2025-53892
• Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables - CVE-2025-68115

Tags:

npm

trix