Executive brief
Trix is a popular rich text editor used in web applications to let users format and compose content. Versions before 2.1.15 are vulnerable to cross-site scripting (XSS) when users paste malicious code—an attacker can trick a user into copying and pasting malicious content that executes arbitrary JavaScript in their browser session, potentially stealing data or performing unauthorized actions on the user's behalf.
Technical details
Trix versions prior to 2.1.15 are vulnerable to stored or reflected XSS (CWE-79) when handling pasted content. The vulnerable component fails to properly sanitize or escape user-supplied HTML/JavaScript during paste operations. An attacker can craft malicious code and socially engineer a user into copying and pasting it into a Trix editor instance; the code then executes in the context of the user's session with their privileges. User interaction (the paste action) is required. The vulnerability has been patched in version 2.1.15 and later.
Affected products
- Basecamp Trix < 2.1.15
Timeline
- 2025-05-08: disclosed
- 2025-05-08: patched: Trix 2.1.15 released