PT-2025-4298 · Trix · Trix

Th4S1S · Published 2025-01-03 · Updated 2025-01-03 · CVE-2025-21610

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trix editor versions prior to 2.1.12

Description Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. The issue arises when pasting malicious code in the link field, allowing an attacker to trick the user into copying and pasting a malicious javascript: URL as a link. This could execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions or sensitive information disclosure.

Recommendations Upgrade to Trix editor version 2.1.12 or later to receive a patch. As a temporary workaround, consider disallowing browsers that don't support a Content Security Policy (CSP) to minimize the risk of exploitation. Set CSP policies such as script-src 'self' to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using script-src-elem.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-21610

GHSA-J386-3444-QGWG

Affected Products

Trix

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21610.json · Exploit
• https://osv.dev/vulnerability/GHSA-j386-3444-qgwg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-21610 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21610 · Security Note
• https://github.com/basecamp/trix · Note
• https://github.com/basecamp/trix/commit/180c8d337f18e1569cea6ef29b4d03ffff5b5faa · Note
• https://github.com/basecamp/trix/security/advisories/GHSA-j386-3444-qgwg · Note
• https://github.com/basecamp/trix/commit/c4f0d6f80654603932af6685694f694e96593b93 · Note
• https://t.me/cvenotify/106205 · Telegram Post
• https://gist.github.com/th4s1s/3921fd9c3e324ad9a3e0d846166e3eb8 · Note
• https://twitter.com/VulmonFeeds/status/1875248360245903364 · Twitter Post
• https://twitter.com/CVEnew/status/1875223461376725152 · Twitter Post
• https://t.me/cvedetector/14230 · Telegram Post