Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session and may perform unauthorized actions or disclose sensitive information.
This issue is fixed in version 2.1.17.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
Required
User action required
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 5
https://github.com/basecamp/trix/commit/3229c29c771ded4d247ed79b2ccd2cd05c4e74b4
security-advisories@github.com
https://github.com/basecamp/trix/commit/53197ab5a142e6b0b76127cb790726b274eaf1bc
security-advisories@github.com
https://github.com/basecamp/trix/pull/1282
security-advisories@github.com
https://github.com/basecamp/trix/releases/tag/v2.1.17
security-advisories@github.com
https://github.com/basecamp/trix/security/advisories/GHSA-qmpg-8xg6-ph5q
security-advisories@github.com