Skip to content
OpenAdvisories
Medium · 5.4 CVE-2024-34341 EUVD-2024-1747GHSA-qjqp-xr96-cj99

The Trix Editor Contains an Arbitrary Code Execution Vulnerability

Published May 7, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Vendor: basecamp Product: trix Package: actiontext Package: trix Ecosystem: npm Ecosystem: RubyGems

Description

Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application. Users should upgrade to Trix editor version 2.1.1 or later, which incorporates proper sanitization of input from copied content.

Affected products

VendorProductAffectedFixed
basecamp trix < 2.1.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed rubygem-rails-7.0 +1 7.0.8.4-1.1 openSUSE-SU-2025:15124-1, openSUSE-SU-2025:15111-1, openSUSE-SU-2024:14074-1

Affected packages

EcosystemPackageAffectedFixedRecord
npm trix >= 2.0.0, < 2.1.1 2.1.1 GHSA-qjqp-xr96-cj99
npm trix >= 0.9.0, < 1.3.2 1.3.2 GHSA-qjqp-xr96-cj99
RubyGems actiontext >= 7.0.0.alpha1, < 7.0.8.3 7.0.8.3 GHSA-qjqp-xr96-cj99
RubyGems actiontext >= 7.1.0.beta1, < 7.1.3.3 7.1.3.3 GHSA-qjqp-xr96-cj99

Advisories 4

References