Skip to content
OpenAdvisories

Package · npm

trix

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 4.6
    CVE-2026-73426

    Trix: Stored XSS vulnerability through serialized attributes

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing …

    basecamp trix trix action_text-trix npm RubyGems
  • Medium 4.6
    CVE-2026-73428

    Trix: Stored XSS via HTMLParser attribute injection on paste

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `<span>` with an empty `d…

    basecamp trix trix action_text-trix npm RubyGems
  • Medium 4.6
    GHSA-g9jg-w8vm-g96v

    Trix has a stored XSS vulnerability through its attachment attribute

    ### Impact The Trix editor, in versions prior to 2.1.16, is vulnerable to XSS attacks through attachment payloads. An attacker could inject malicious code into a data-trix-attachment attribute that, when rendered as HTML and clicked on, could execute arbitrar…

    trix action_text-trix npm RubyGems
  • Medium 5.3
    CVE-2025-21610

    Trix allows Cross-site Scripting via `javascript:` url in a link

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scripting when pasting malicious code in the link field. An attacker could trick the user to copy&paste a malicious `javascript…

    basecamp trix trix npm
  • Medium 5.1
    CVE-2024-53847

    Trix vulnerable to Cross-site Scripting on copy & paste

    The Trix rich text editor, prior to versions 2.1.9 and 1.3.3, is vulnerable to cross-site scripting (XSS) + mutation XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScri…

    basecamp trix trix npm
  • Medium 6.5
    CVE-2024-43368

    Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste

    The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in place for GHSA-qjqp-xr96-cj99. In pull request 1149, sanitation was added for Trix attachments with a `text/html` cont…

    basecamp trix trix npm
  • Medium 5.4
    CVE-2024-34341

    The Trix Editor Contains an Arbitrary Code Execution Vulnerability

    Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of…

    basecamp trix trix actiontext npm RubyGems