Skip to content
OpenAdvisories

Vendor

basecamp

11 known vulnerabilities.

basecamp at a glance

Last 12 months
4
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 3 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 1 vulnerability November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202610
Sep 202600
Aug 202630
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202520
Jul 202500
Jun 202500
May 202510
Apr 202500
Mar 202500
Feb 202500
Jan 202510
Dec 202410

Products

trix 8 google_sign_in 2 once-campfire 1
All Critical High Medium Low Exploited only Public exploit

11 results · Feed

  • Low 3.1
    CVE-2026-100355

    Campfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guard

    Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. `RestrictedHTTP::PrivateNetworkGuard` relied on Ruby's `IPAddr#private? `` IPAddr#loop…

    basecamp once-campfire
  • Medium 4.6
    CVE-2026-73426

    Trix: Stored XSS vulnerability through serialized attributes

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing …

    basecamp trix trix action_text-trix npm RubyGems
  • Medium 4.6
    CVE-2026-73428

    Trix: Stored XSS via HTMLParser attribute injection on paste

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `<span>` with an empty `d…

    basecamp trix trix action_text-trix npm RubyGems
  • Low 2.1
    CVE-2026-73427

    Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputControlle…

    basecamp trix trix action_text-trix npm RubyGems
  • Medium 4.2
    CVE-2025-58067

    Basecamp's Google Sign-In for Rails allowed redirects to protocol-relative URI

    Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.1, it is possible to redirect a user to another origin if the "proceed_to" value in the session store is set to a protocol-relative URL. Normally the value of this URL i…

    basecamp google_sign_in google_sign_in RubyGems
  • Medium 4.2
    CVE-2025-57821

    Basecamp's Google Sign-In for Rails allowed redirects to a malformed URL

    Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.0, it is possible to craft a malformed URL that passes the "same origin" check, resulting in the user being redirected to another origin. Rails applications configured t…

    basecamp google_sign_in google_sign_in RubyGems
  • Low 2.0
    CVE-2025-46812

    Trix vulnerable to Cross-site Scripting on copy & paste

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.15 are vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary Java…

    basecamp trix trix npm
  • Medium 5.3
    CVE-2025-21610

    Trix allows Cross-site Scripting via `javascript:` url in a link

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scripting when pasting malicious code in the link field. An attacker could trick the user to copy&paste a malicious `javascript…

    basecamp trix trix npm
  • Medium 5.1
    CVE-2024-53847

    Trix vulnerable to Cross-site Scripting on copy & paste

    The Trix rich text editor, prior to versions 2.1.9 and 1.3.3, is vulnerable to cross-site scripting (XSS) + mutation XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScri…

    basecamp trix trix npm
  • Medium 6.5
    CVE-2024-43368

    Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste

    The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in place for GHSA-qjqp-xr96-cj99. In pull request 1149, sanitation was added for Trix attachments with a `text/html` cont…

    basecamp trix trix npm
  • Medium 5.4
    CVE-2024-34341

    The Trix Editor Contains an Arbitrary Code Execution Vulnerability

    Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of…

    basecamp trix trix actiontext npm RubyGems