Executive brief
Trix is a popular JavaScript editor component used to provide rich text editing in web applications. The editor is vulnerable to cross-site scripting (XSS) attacks when a user pastes a malicious javascript: URL into the link field. An attacker can trick users into copying and pasting such a link, causing arbitrary JavaScript code to execute in the user's browser session, potentially leading to credential theft, unauthorized actions, or data exfiltration.
Technical details
Trix versions prior to 2.1.11 fail to properly sanitize or validate javascript: protocol URLs when inserted into link fields, resulting in a stored XSS vulnerability (CWE-79). An attacker exploits this by crafting a malicious javascript: URL and socially engineering a user to paste it into the Trix editor's link field. The attack requires user interaction (copying and pasting the malicious URL) and runs in the victim's browser with their session context and privileges. The vulnerability has been patched in version 2.1.12 and later; users can also mitigate by implementing strict Content Security Policy headers (e.g., script-src 'self') to prevent inline script execution.
Affected products
- Basecamp Trix prior to 2.1.12
Timeline
- 2025-01-03: disclosed
- 2025-01-03: patched: version 2.1.12 released