Trix has a Stored XSS vulnerability through serialized attributes

Description

The Trix editor, in versions prior to 2.1.17, is vulnerable to XSS attacks when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer.

Recommendation

Update the trix package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.1.17
• Patched version(s): 2.1.17

References

• GHSA-qmpg-8xg6-ph5q
• CWE-79
• OWASP 2021-A3

Related Issues

• Trix has a stored XSS vulnerability through its attachment attribute - Vulnerability
• Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController) - Vulnerability
• Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page - Vulnerability
• Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

These 7 PHP mistakes leave your website open to the hackers

How do hackers hack websites?

Tags:

npm

trix