Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
9 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when crafted HTML is pasted into the editor. The HTMLParser processed a mock attachment, a <span carrying an empty data-trix-attachment="{}". The empty attachment object caused the element to bypass attachment handling, so its data-trix-attributes were applied to a plain string piece. The pre-2.1.18 StringPiece.fromJSON accepted the href without validation, so an attacker-supplied javascript: URI was carried into the document model and emitted verbatim into the serialized HTML, executing when the content was rendered and clicked. This is a stored XSS in any application that accepts untrusted rich text through Trix and renders the serialized output to other users. Applications that apply server-side HTML sanitization, such as the Rails built-in sanitizer, are additionally protected because the payload is neutralized on save. This vulnerability shares its fix with GHSA-53p3-c7vp-4mcc. Both are resolved by the…
Recommended action: Upgrade to 2.1.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when a crafted application/x-trix-document JSON payload is dropped into the editor in environments using the fallback Level0InputController (e.g., embedded WebViews lacking Input Events Level 2 support). The StringPiece.fromJSON method trusted href attributes from the JSON payload without sanitization. An attacker could craft a draggable element containing a javascript: URI in the href attribute that, when dropped into a vulnerable editor, would bypass DOMPurify sanitization and inject executable JavaScript into the DOM. Exploitation requires a specific environment (Level0InputController fallback) and social engineering (victim must drag and drop attacker-controlled content into the editor). Applications using server-side HTML sanitization (such as Rails' built-in sanitizer) are additionally protected, as the payload is neutralized on save. Patches Update Recommendation: Users should upgrade to Trix editor…
Recommended action: Upgrade to 2.1.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The Trix editor, in versions prior to 2.1.17, is vulnerable to XSS attacks when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker could craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when the content is rendered, could execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Patches Update Recommendation: Users should upgrade to Trix editor version 2.1.17 or later. References The XSS vulnerability was responsibly reported by Hackerone researcher newbiefromcoma.
Recommended action: Upgrade to 2.1.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The Trix editor, in versions prior to 2.1.16, is vulnerable to XSS attacks through attachment payloads. An attacker could inject malicious code into a data-trix-attachment attribute that, when rendered as HTML and clicked on, could execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Patches Update Recommendation: Users should upgrade to Trix editor version 2.1.16 or later. Resources The XSS vulnerability was reported by HackerOne researcher michaelcheers.
Recommended action: Upgrade to 2.1.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The Trix editor, in versions prior to 2.1.15, is vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Patches Update Recommendation: Users should upgrade to Trix editor version 2.1.15 or later. References The XSS vulnerability was reported by HackerOne researcher hiumee.
Recommended action: Upgrade to 2.1.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Trix editor, versions prior to 2.1.11, is vulnerable to XSS when pasting malicious code in the link field. Impact An attacker could trick the user to copy&paste a malicious javascript: URL as a link that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. See https://gist.github.com/th4s1s/3921fd9c3e324ad9a3e0d846166e3eb8 Patches Update Recommendation: Users should upgrade to Trix editor version 2.1.12 or later. Workarounds This is not really a workaround but something that should be considered in addition to upgrading to the patched version. If affected users can disallow browsers that don't support a Content Security Policy, then this would be an effective workaround for this and all XSS vulnerabilities. Set CSP policies such as script-src 'self' to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline…
Recommended action: Upgrade to 2.1.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Trix editor, in versions prior to 2.1.9 and 1.3.3, is vulnerable to XSS + mutation XSS attacks when pasting malicious code. Impact An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Patches Update Recommendation: Users should upgrade to Trix editor version 2.1.9 or later, which uses DOMPurify to sanitize the pasted content. If using Trix 1.x, upgrade to version 1.3.3 or later. Mitigations This is not really a workaround but something that should be considered in addition to upgrading to the patched version. If affected users can disallow browsers that don't support a Content Security Policy, then this would be an effective workaround for this and all XSS vulnerabilities. Set CSP policies such as script-src 'self' to ensure that only scripts hosted on the same origin are executed,…
Recommended action: Upgrade to 2.1.9 or 1.3.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in place for https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99. In https://github.com/basecamp/trix/pull/1149, we added sanitation for Trix attachments with a text/html content type. However, Trix only checks the content type on the paste event's dataTransfer object. As long as the dataTransfer has a content type of text/html, Trix parses its contents and creates an Attachment with them, even if the attachment itself doesn't have a text/html content type. Trix then uses the attachment content to set the attachment element's innerHTML. Impact An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Patches Update Recommendation: Users…
Recommended action: Upgrade to 2.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application. Vulnerable Versions: - 1.x series up to and including 1.3.1 - 2.x series up to and including 2.1.0 Fixed Versions: - v1.3.2 - v2.1.1 Vector: - Bug 1: When copying content manipulated by a script, such as: and pasting into the Trix editor, the script within the content is executed. - Bug 2: Similar execution occurs with content structured as: Impact: An attacker could exploit these vulnerabilities to execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Remediation: Update Recommendation: Users should upgrade to…
Recommended action: Upgrade to 2.1.1 or 1.3.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.