Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 31 December 2025.

Which products and versions are affected?

trix (npm) SEMVER:introduced=0,fixed=2.1.16; action_text-trix (RubyGems) ECOSYSTEM:introduced=0,fixed=2.1.16.

Is there a fix for This vulnerability?

Yes. trix (npm): upgrade to 2.1.16 or later; action_text-trix (RubyGems): upgrade to 2.1.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run trix (npm) or action_text-trix (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Basecamp Trix stored XSS in attachment attribute

Severity: low · CVSS 3.1 · Published 2025-12-31

Trix is a popular rich-text editor library used in web applications to allow users to compose and format content. The editor is vulnerable to stored cross-site scripting (XSS) attacks through malicious attachment attributes that, when clicked, execute arbitrary JavaScript in a user's browser. An attacker with the ability to inject content (such as through a comment or document) could steal session tokens, perform unauthorized actions, or steal sensitive information from users viewing the malicious content.

Technologies: trix (npm), action_text-trix (RubyGems). Vendors: npm, RubyGems.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 31 December 2025.
Which products and versions are affected?: trix (npm) SEMVER:introduced=0,fixed=2.1.16; action_text-trix (RubyGems) ECOSYSTEM:introduced=0,fixed=2.1.16.
Is there a fix for This vulnerability?: Yes. trix (npm): upgrade to 2.1.16 or later; action_text-trix (RubyGems): upgrade to 2.1.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run trix (npm) or action_text-trix (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

trix (npm): upgrade to 2.1.16 or later
```
npm install trix@2.1.16
```
action_text-trix (RubyGems): upgrade to 2.1.16 or later
```
bundle update action_text-trix
```

Technical details

This is a stored XSS vulnerability (CWE-79) in Trix versions prior to 2.1.16, triggered through the data-trix-attachment attribute. The root cause is improper validation of attachment href attributes before rendering them as HTML anchor tags. An attacker with low privilege access and requiring user interaction (clicking the malicious link) can inject arbitrary JavaScript that executes in the security context of the user's session. The fix, released in version 2.1.16, uses DOMPurify.isValidAttribute() to validate attachment href attributes before rendering them. The vulnerability was reported by HackerOne researcher michaelcheers and is not known to be exploited in the wild.

Affected products

Basecamp Trix before 2.1.16
Basecamp action_text-trix before 2.1.16

Timeline

2025-12-31: disclosed: Advisory GHSA-g9jg-w8vm-g96v published
2025-12-31: patched: Version 2.1.16 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.