Skip to content
OpenAdvisories

Vendor

basecamp

11 known vulnerabilities.

Products

trix 8 google_sign_in 2 once-campfire 1
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 4.6
    CVE-2026-73426

    Trix: Stored XSS vulnerability through serialized attributes

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing …

    basecamp trix trix action_text-trix npm RubyGems
  • Medium 4.6
    CVE-2026-73428

    Trix: Stored XSS via HTMLParser attribute injection on paste

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `<span>` with an empty `d…

    basecamp trix trix action_text-trix npm RubyGems
  • Medium 4.2
    CVE-2025-58067

    Basecamp's Google Sign-In for Rails allowed redirects to protocol-relative URI

    Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.1, it is possible to redirect a user to another origin if the "proceed_to" value in the session store is set to a protocol-relative URL. Normally the value of this URL i…

    basecamp google_sign_in google_sign_in RubyGems
  • Medium 4.2
    CVE-2025-57821

    Basecamp's Google Sign-In for Rails allowed redirects to a malformed URL

    Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.0, it is possible to craft a malformed URL that passes the "same origin" check, resulting in the user being redirected to another origin. Rails applications configured t…

    basecamp google_sign_in google_sign_in RubyGems
  • Medium 5.3
    CVE-2025-21610

    Trix allows Cross-site Scripting via `javascript:` url in a link

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scripting when pasting malicious code in the link field. An attacker could trick the user to copy&paste a malicious `javascript…

    basecamp trix trix npm
  • Medium 5.1
    CVE-2024-53847

    Trix vulnerable to Cross-site Scripting on copy & paste

    The Trix rich text editor, prior to versions 2.1.9 and 1.3.3, is vulnerable to cross-site scripting (XSS) + mutation XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScri…

    basecamp trix trix npm
  • Medium 6.5
    CVE-2024-43368

    Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste

    The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in place for GHSA-qjqp-xr96-cj99. In pull request 1149, sanitation was added for Trix attachments with a `text/html` cont…

    basecamp trix trix npm
  • Medium 5.4
    CVE-2024-34341

    The Trix Editor Contains an Arbitrary Code Execution Vulnerability

    Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of…

    basecamp trix trix actiontext npm RubyGems