Executive brief
Trix is a popular rich-text editor library used in web applications to allow users to compose and format content. The editor is vulnerable to stored cross-site scripting (XSS) attacks through malicious attachment attributes that, when clicked, execute arbitrary JavaScript in a user's browser. An attacker with the ability to inject content (such as through a comment or document) could steal session tokens, perform unauthorized actions, or steal sensitive information from users viewing the malicious content.
Technical details
This is a stored XSS vulnerability (CWE-79) in Trix versions prior to 2.1.16, triggered through the data-trix-attachment attribute. The root cause is improper validation of attachment href attributes before rendering them as HTML anchor tags. An attacker with low privilege access and requiring user interaction (clicking the malicious link) can inject arbitrary JavaScript that executes in the security context of the user's session. The fix, released in version 2.1.16, uses DOMPurify.isValidAttribute() to validate attachment href attributes before rendering them. The vulnerability was reported by HackerOne researcher michaelcheers and is not known to be exploited in the wild.
Affected products
- Basecamp Trix before 2.1.16
- Basecamp action_text-trix before 2.1.16
Timeline
- 2025-12-31: disclosed: Advisory GHSA-g9jg-w8vm-g96v published
- 2025-12-31: patched: Version 2.1.16 released with fix