Skip to content
OpenAdvisories

Package · npm

trix

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 2.1
    CVE-2026-73427

    Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputControlle…

    basecamp trix trix action_text-trix npm RubyGems
  • Low 2.0
    CVE-2025-46812

    Trix vulnerable to Cross-site Scripting on copy & paste

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.15 are vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary Java…

    basecamp trix trix npm