PT-2025-20399 · Trix · Trix

Djmb · Published 2025-05-08 · Updated 2025-05-08 · CVE-2025-46812

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Trix versions prior to 2.1.15

Description The issue allows an attacker to execute arbitrary JavaScript code within the context of a user's session by tricking the user into copying and pasting malicious code. This could potentially lead to unauthorized actions or sensitive information disclosure.

Recommendations For versions prior to 2.1.15, update to version 2.1.15 or later to resolve the issue. As a temporary workaround, consider restricting the ability to paste code into the editor until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-46812

GHSA-MCRW-746G-9Q8H

Affected Products

Trix

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46812.json · Exploit
• https://osv.dev/vulnerability/GHSA-mcrw-746g-9q8h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-46812 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46812 · Security Note
• https://github.com/basecamp/trix · Note
• https://github.com/basecamp/trix/security/advisories/GHSA-mcrw-746g-9q8h · Note
• https://github.com/basecamp/trix/commit/75226089646841b0f774d8b152e5ec27d2d9e191 · Note
• https://t.me/cvetracker/23398 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1920618306140069917 · Twitter Post
• https://twitter.com/CVEnew/status/1920595164822901002 · Twitter Post
• https://t.me/cvedetector/24868 · Telegram Post