Trix
Monthly
Cross-site scripting in Trix rich text editor versions prior to 2.1.17 allows network-reachable attackers with content-insertion privileges to execute arbitrary JavaScript in victims' browser sessions. The DOMPurify sanitizer lacked a hook to explicitly block the `data-trix-serialized-attributes` attribute, enabling crafted attachment HTML to survive sanitization and fire event handlers such as `onerror` upon rendering. No CISA KEV listing was identified at time of analysis, but the fix PR publicly exposes a working test payload, materially lowering the barrier to exploitation.
Cross-site scripting in Trix editor prior to 2.1.18 allows DOM injection via unsanitized `javascript:` URIs deserialized from attacker-controlled JSON payloads during drag-and-drop operations. The vulnerable path exists exclusively in environments using the Level0InputController fallback - such as embedded WebViews lacking Input Events Level 2 support - where `StringPiece.fromJSON` applied `href` attributes from `application/x-trix-document` JSON directly to anchor elements, bypassing the DOMPurify checks that protected the HTML serialization path. No public exploit or active exploitation (CISA KEV) has been identified; the CVSS 4.0 score of 2.1 accurately reflects the constrained exploitability.
Cross-site scripting in Trix rich text editor versions prior to 2.1.17 allows network-reachable attackers with content-insertion privileges to execute arbitrary JavaScript in victims' browser sessions. The DOMPurify sanitizer lacked a hook to explicitly block the `data-trix-serialized-attributes` attribute, enabling crafted attachment HTML to survive sanitization and fire event handlers such as `onerror` upon rendering. No CISA KEV listing was identified at time of analysis, but the fix PR publicly exposes a working test payload, materially lowering the barrier to exploitation.
Cross-site scripting in Trix editor prior to 2.1.18 allows DOM injection via unsanitized `javascript:` URIs deserialized from attacker-controlled JSON payloads during drag-and-drop operations. The vulnerable path exists exclusively in environments using the Level0InputController fallback - such as embedded WebViews lacking Input Events Level 2 support - where `StringPiece.fromJSON` applied `href` attributes from `application/x-trix-document` JSON directly to anchor elements, bypassing the DOMPurify checks that protected the HTML serialization path. No public exploit or active exploitation (CISA KEV) has been identified; the CVSS 4.0 score of 2.1 accurately reflects the constrained exploitability.