Quick answers
- Is CVE-2024-53847 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-53847 being exploited in the wild.
- How severe is CVE-2024-53847?
- Medium severity, with a CVSS score of 4, published 9 December 2024.
- Which products and versions are affected?
- trix (npm) SEMVER:introduced=2.0.0,fixed=2.1.9.
- Is there a fix for CVE-2024-53847?
- Yes. trix (npm): upgrade to 2.1.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-53847 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2024-53847?
- Check whether you run trix (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- trix (npm): upgrade to 2.1.9 or later
npm install trix@2.1.9
Technical details
Trix versions prior to 2.1.9 (2.x branch) and 1.3.3 (1.x branch) fail to properly sanitize user input during paste operations, allowing both traditional XSS and mutation XSS (mXSS) attacks. The vulnerability exists in the paste handling logic, which does not neutralize HTML/JavaScript payloads before insertion into the DOM. Attack requires user interaction (copy-paste action) but no authentication or special network configuration; the malicious JavaScript executes within the user's browser session with full context access. The fix involves upgrading to patched versions (2.1.9+, 1.3.3+) which implement DOMPurify sanitization for pasted content.
Affected products
- Basecamp Trix >=2.0.0, <2.1.9; >=1.0.0, <1.3.3
Identifiers
- CVE-2024-53847
- GHSA-6vx4-v2jw-qwqh
Timeline
- 2024-12-09: disclosed
- 2024-12-09: patched: Trix 2.1.9 and 1.3.3 released