EUVD-2026-60825
GHSA-qmpg-8xg6-ph5q
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Attacker needs low-privilege content submission (PR:L) and victim must view output (UI:R); no availability impact and scope remains unchanged.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session and may perform unauthorized actions or disclose sensitive information. This issue is fixed in version 2.1.17.
AnalysisAI
Cross-site scripting in Trix rich text editor versions prior to 2.1.17 allows network-reachable attackers with content-insertion privileges to execute arbitrary JavaScript in victims' browser sessions. The DOMPurify sanitizer lacked a hook to explicitly block the data-trix-serialized-attributes attribute, enabling crafted attachment HTML to survive sanitization and fire event handlers such as onerror upon rendering. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have the ability to submit content that is stored and subsequently rendered by a Trix editor instance in a multi-user application - for example, write access to a post, comment, task, or document field backed by ActionText. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 4.6 (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) correctly categorizes this as a medium-severity finding: the attacker must control storable content (PR:L) and a victim must load the rendered page (UI:R), which meaningfully limits opportunistic mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a standard user account in a multi-user Rails ActionText application (such as a shared document editor or support-ticket system) pastes crafted HTML into a Trix editor field; the payload embeds a `data-trix-attachment` element whose inner content contains `data-trix-serialized-attributes` with an `onerror` handler referencing `document.cookie`. DOMPurify passes the attribute through without stripping it, and the malicious content is stored. … |
| Remediation | Upgrade Trix to version 2.1.17 or later - for npm consumers run `npm update trix`, for RubyGems consumers run `bundle update action_text-trix` - which introduces an explicit DOMPurify `uponSanitizeAttribute` hook that sets `keepAttr = false` for any `data-trix-serialized-attributes` attribute, closing the sanitizer bypass at its root. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today