Vulnerability · Published Dec 9, 2024 · Assigned by GitHub_M

CVE-2024-53847Trix vulnerable to Cross-site Scripting on copy & paste

Medium 5.1

In plain English

A medium-severity cross-site scripting in trix from basecamp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.5%top 59.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Trix rich text editor, prior to versions 2.1.9 and 1.3.3, is vulnerable to cross-site scripting (XSS) + mutation XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Users should upgrade to Trix editor version 2.1.9 or 1.3.3, which uses DOMPurify to sanitize the pasted content.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	trix	2.1.9	GHSA-6vx4-v2jw-qwqh
npm	trix	1.3.3	GHSA-6vx4-v2jw-qwqh

Affected products (as reported)

Vendor	Product	Versions
basecamp	trix	>= 2.0.0, < 2.1.9>= 1.0.0, < 1.3.3

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://github.com/basecamp/trix/security/advisories/GHSA-6vx4-v2jw-qwqh x_refsource_CONFIRM
https://github.com/basecamp/trix/commit/272c7e27e722608732a67108ad3fe7870e233ac8 x_refsource_MISC