Executive brief
Trix is a popular rich-text editor component used in web applications to allow users to compose formatted content. Attackers can exploit XSS vulnerabilities by tricking users into copying and pasting malicious code, which then executes JavaScript in their browser session. This could allow unauthorized actions or disclosure of sensitive information without requiring any special permissions or technical sophistication from the attacker.
Technical details
Trix versions prior to 2.1.9 (2.x branch) and 1.3.3 (1.x branch) fail to properly sanitize user input during paste operations, allowing both traditional XSS and mutation XSS (mXSS) attacks. The vulnerability exists in the paste handling logic, which does not neutralize HTML/JavaScript payloads before insertion into the DOM. Attack requires user interaction (copy-paste action) but no authentication or special network configuration; the malicious JavaScript executes within the user's browser session with full context access. The fix involves upgrading to patched versions (2.1.9+, 1.3.3+) which implement DOMPurify sanitization for pasted content.
Affected products
- Basecamp Trix >=2.0.0, <2.1.9; >=1.0.0, <1.3.3
Timeline
- 2024-12-09: disclosed
- 2024-12-09: patched: Trix 2.1.9 and 1.3.3 released