CVE-2024-53847

Description

The Trix rich text editor, prior to versions 2.1.9 and 1.3.3, is vulnerable to cross-site scripting (XSS) + mutation XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Users should upgrade to Trix editor version 2.1.9 or 1.3.3, which uses DOMPurify to sanitize the pasted content.

Reserved 2024-11-22 | Published 2024-12-09 | Updated 2024-12-10 | Assigner GitHub_M

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

>= 2.0.0, < 2.1.9
affected

>= 1.0.0, < 1.3.3
affected

References

github.com/...p/trix/security/advisories/GHSA-6vx4-v2jw-qwqh

github.com/...ommit/272c7e27e722608732a67108ad3fe7870e233ac8

cve.org (CVE-2024-53847)

nvd.nist.gov (CVE-2024-53847)

Download JSON