PT-2024-35949 · Trix+1 · Trix+1

Hiumee + 1 · Published 2024-12-09 · Updated 2025-03-26 · CVE-2024-53847

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions: Trix editor versions prior to 2.1.9 and 1.3.3

Description: The issue concerns cross-site scripting (XSS) and mutation XSS attacks when pasting malicious code. An attacker could trick a user into copying and pasting malicious code, leading to the execution of arbitrary JavaScript code within the user's session. This could result in unauthorized actions or the disclosure of sensitive information.

Recommendations: For versions prior to 2.1.9, upgrade to version 2.1.9 or later, which uses DOMPurify to sanitize pasted content. For versions prior to 1.3.3, upgrade to version 1.3.3 or later. As a mitigation measure, consider disallowing browsers that do not support a Content Security Policy and set policies such as script-src 'self' to ensure only scripts from the same origin are executed, and prohibit inline scripts using script-src-elem.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2025-3714

CVE-2024-53847

GHSA-6VX4-V2JW-QWQH

Affected Products

Alt Linux

Trix

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53847.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-53847 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53847 · Security Note
• https://osv.dev/vulnerability/GHSA-6vx4-v2jw-qwqh · Vendor Advisory
• https://github.com/basecamp/trix · Note
• https://github.com/basecamp/trix/commit/272c7e27e722608732a67108ad3fe7870e233ac8 · Note
• https://github.com/basecamp/trix/security/advisories/GHSA-6vx4-v2jw-qwqh · Note
• https://twitter.com/VulmonFeeds/status/1866253980818345998 · Twitter Post
• https://twitter.com/CVEnew/status/1866202699819360450 · Twitter Post
• https://t.me/cvedetector/12439 · Telegram Post