Vulnerability · Published May 7, 2024 · Assigned by GitHub_M
CVE-2024-34341The Trix Editor Contains an Arbitrary Code Execution Vulnerability
Medium 5.4
In plain English
A medium-severity cross-site scripting in trix from basecamp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application. Users should upgrade to Trix editor version 2.1.1 or later, which incorporates proper sanitization of input from copied content.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| RubyGems | actiontext | 7.0.8.3 | GHSA-qjqp-xr96-cj99 |
| RubyGems | actiontext | 7.1.3.3 | GHSA-qjqp-xr96-cj99 |
| npm | trix | 2.1.1 | GHSA-qjqp-xr96-cj99 |
| npm | trix | 1.3.2 | GHSA-qjqp-xr96-cj99 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
References
- https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99 x_refsource_CONFIRM
- https://github.com/basecamp/trix/pull/1147 x_refsource_MISC
- https://github.com/basecamp/trix/pull/1149 x_refsource_MISC
- https://github.com/basecamp/trix/commit/1a5c68a14d48421fc368e30026f4a7918028b7ad x_refsource_MISC
- https://github.com/basecamp/trix/commit/841ff19b53f349915100bca8fcb488214ff93554 x_refsource_MISC
- https://github.com/basecamp/trix/releases/tag/v2.1.1 x_refsource_MISC