Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when crafted HTML is pasted into the editor. The HTMLParser processed a mock attachment, a <span carrying an empty data-trix-attachment="{}". The empty attachment object caused the element to bypass attachment handling, so its data-trix-attributes were applied to a plain string piece. The pre-2.1.18 StringPiece.fromJSON accepted the href without validation, so an attacker-supplied javascript: URI was carried into the document model and emitted verbatim into the serialized HTML, executing when the content was rendered and clicked. This is a stored XSS in any application that accepts untrusted rich text through Trix and renders the serialized output to other users. Applications that apply server-side HTML sanitization, such as the Rails built-in sanitizer, are additionally protected because the payload is neutralized on save. This vulnerability shares its fix with GHSA-53p3-c7vp-4mcc. Both are resolved by the…
Recommended action: Upgrade to 2.1.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when a crafted application/x-trix-document JSON payload is dropped into the editor in environments using the fallback Level0InputController (e.g., embedded WebViews lacking Input Events Level 2 support). The StringPiece.fromJSON method trusted href attributes from the JSON payload without sanitization. An attacker could craft a draggable element containing a javascript: URI in the href attribute that, when dropped into a vulnerable editor, would bypass DOMPurify sanitization and inject executable JavaScript into the DOM. Exploitation requires a specific environment (Level0InputController fallback) and social engineering (victim must drag and drop attacker-controlled content into the editor). Applications using server-side HTML sanitization (such as Rails' built-in sanitizer) are additionally protected, as the payload is neutralized on save. Patches Update Recommendation: Users should upgrade to Trix editor…
Recommended action: Upgrade to 2.1.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The Trix editor, in versions prior to 2.1.17, is vulnerable to XSS attacks when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker could craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when the content is rendered, could execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Patches Update Recommendation: Users should upgrade to Trix editor version 2.1.17 or later. References The XSS vulnerability was responsibly reported by Hackerone researcher newbiefromcoma.
Recommended action: Upgrade to 2.1.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The Trix editor, in versions prior to 2.1.16, is vulnerable to XSS attacks through attachment payloads. An attacker could inject malicious code into a data-trix-attachment attribute that, when rendered as HTML and clicked on, could execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Patches Update Recommendation: Users should upgrade to Trix editor version 2.1.16 or later. Resources The XSS vulnerability was reported by HackerOne researcher michaelcheers.
Recommended action: Upgrade to 2.1.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.