The Trix Editor Contains an Arbitrary Code Execution Vulnerability
Priority LOW 26CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application. Users should upgrade to Trix editor version 2.1.1 or later, which incorporates proper sanitization of input from copied content.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00784 56th percentileScored 2026-11-07
Fix Fixed trix (basecamp): 2.1.1trix (npm): 2.1.1, 1.3.2+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| basecamp | trix | before 2.1.1 | 2.1.1 | Patch available | CNA |
| — | trix (npm) | 2.0.0 to before 2.1.1 | 2.1.1 | Patch available | GHSA-qjqp-xr96-cj99 |
| — | trix (npm) | 0.9.0 to before 1.3.2 | 1.3.2 | Patch available | GHSA-qjqp-xr96-cj99 |
| — | actiontext (RubyGems) | 7.0.0.alpha1 to before 7.0.8.3 | 7.0.8.3 | Patch available | GHSA-qjqp-xr96-cj99 |
| — | actiontext (RubyGems) | 7.1.0.beta1 to before 7.1.3.3 | 7.1.3.3 | Patch available | GHSA-qjqp-xr96-cj99 |
- trix Vendorbasecamp Affected before 2.1.1 Fixed in 2.1.1 Patch available CNA
- trix (npm) Vendor— Affected 2.0.0 to before 2.1.1 Fixed in 2.1.1 Patch available GHSA-qjqp-xr96-cj99
- trix (npm) Vendor— Affected 0.9.0 to before 1.3.2 Fixed in 1.3.2 Patch available GHSA-qjqp-xr96-cj99
- actiontext (RubyGems) Vendor— Affected 7.0.0.alpha1 to before 7.0.8.3 Fixed in 7.0.8.3 Patch available GHSA-qjqp-xr96-cj99
- actiontext (RubyGems) Vendor— Affected 7.1.0.beta1 to before 7.1.3.3 Fixed in 7.1.3.3 Patch available GHSA-qjqp-xr96-cj99
Remediation
- Fix · CNA trix (basecamp) Fixed in 2.1.1
- Fix · GHSA-qjqp-xr96-cj99 trix (npm) Fixed in 2.1.1 Advisory →
- Fix · GHSA-qjqp-xr96-cj99 trix (npm) Fixed in 1.3.2 Advisory →
- Fix · GHSA-qjqp-xr96-cj99 actiontext (RubyGems) Fixed in 7.0.8.3 Advisory →
- Fix · GHSA-qjqp-xr96-cj99 actiontext (RubyGems) Fixed in 7.1.3.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-34341
- 2026-10-03 Alias added: GHSA-qjqp-xr96-cj99
References
Other 14
- https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99
- https://github.com/basecamp/trix/pull/1147
- https://github.com/basecamp/trix/pull/1149
- https://github.com/basecamp/trix/commit/1a5c68a14d48421fc368e30026f4a7918028b7ad
- https://github.com/basecamp/trix/commit/841ff19b53f349915100bca8fcb488214ff93554
- https://github.com/basecamp/trix/releases/tag/v2.1.1
- https://github.com/rails/rails/commit/07e6c88cc4defe6f6b8d28e79eb13a518e15b14c
- https://github.com/rails/rails/commit/260cb392fc1ee91d0b749cff08d1c8d54b230bd3
- https://github.com/rails/rails/commit/73fac32511eefdd45d8f00fecc2b8cc5408ea6d5
- https://discuss.rubyonrails.org/t/xss-vulnerabilities-in-trix-editor/85803
- https://github.com/basecamp/trix
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actiontext/CVE-2024-34341.yml
- https://rubyonrails.org/2024/5/17/Rails-Versions-7-0-8-2-and-7-1-3-3-have-been-released
- https://rubyonrails.org/2024/5/17/Rails-Versions-7-0-8-3-has-been-released
More basecamp vulnerabilities
- TI-2023-18436 Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1… CVSS 3.1HIGH 7.5
- TI-2024-29019 Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste CVSS 3.1MEDIUM 6.5
- TI-2024-36043 Trix vulnerable to Cross-site Scripting on copy & paste CVSS 4.0MEDIUM 5.1
- TI-2018-16075 easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in… CVSS 3.1MEDIUM 6.1
- TI-2025-15570 Trix allows Cross-site Scripting via `javascript:` url in a link CVSS 3.1MEDIUM 5.3
- TI-2026-51546 Trix: Stored XSS via HTMLParser attribute injection on paste CVSS 3.1MEDIUM 4.6
Sources
- CVE-2024-34341 · CVE Program
- CVE-2024-34341 · NVD
- FIRST EPSS
- GHSA-qjqp-xr96-cj99 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences