CVE-2025-46812

CVE-2025-46812 · Trix vulnerable to Cross-site Scripting on copy & paste

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.15 are vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. This issue has been patched in version 2.1.15.

CVSS 2.0 · Low · EPSS 0.7% · Fix available

Published: 2025-05-08T19:27:22.573Z
Updated: 2025-05-08T20:00:42.604Z

Stack: node

Affected products and versions

trix
Versions
- < 2.1.15: Affected
No fix published
trix npm
Affected ranges
- SEMVER: < 2.1.15
Update to 2.1.15

Original sources

https://github.com/basecamp/trix/security/advisories/GHSA-mcrw-746g-9q8h
https://github.com/basecamp/trix/commit/75226089646841b0f774d8b152e5ec27d2d9e191
https://nvd.nist.gov/vuln/detail/CVE-2025-46812

Check your server →

CVE-2025-46812 · Trix vulnerable to Cross-site Scripting on copy & paste

Affected products and versions

trix

trix npm

Original sources