Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in place for GHSA-qjqp-xr96-cj99. In pull request 1149, sanitation was added for Trix attachments with a `text/html` content type. However, Trix only checks the content type on the paste event's `dataTransfer` object. As long as the `dataTransfer` has a content type of `text/html`, Trix parses its contents and creates an `Attachment` with them, even if the attachment itself doesn't have a `text/html` content type. Trix then uses the attachment content to set the attachment element's `innerHTML`. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. This vulnerability was fixed in version 2.1.4.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| basecamp | trix | before 2.1.4 | 2.1.4 | Patch available | CNA |
| — | trix (npm) | before 2.1.4 | 2.1.4 | Patch available | GHSA-qm2q-9f3q-2vcv |
- trix Vendorbasecamp Affected before 2.1.4 Fixed in 2.1.4 Patch available CNA
- trix (npm) Vendor— Affected before 2.1.4 Fixed in 2.1.4 Patch available GHSA-qm2q-9f3q-2vcv
Remediation
- Fix · CNA trix (basecamp) Fixed in 2.1.4
- Fix · GHSA-qm2q-9f3q-2vcv trix (npm) Fixed in 2.1.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-43368
- 2026-10-03 Alias added: GHSA-qm2q-9f3q-2vcv
References
Other 8
- https://github.com/basecamp/trix/security/advisories/GHSA-qm2q-9f3q-2vcv
- https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99
- https://github.com/basecamp/trix/pull/1149
- https://github.com/basecamp/trix/pull/1156
- https://github.com/basecamp/trix/commit/7656f578af0d03141a72a9d27cb3692e6947dae6
- https://github.com/basecamp/trix/releases/tag/v2.1.4
- https://developer.mozilla.org/en-US/docs/Web/API/DataTransfer
- https://github.com/basecamp/trix
More basecamp vulnerabilities
- TI-2023-18436 Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1… CVSS 3.1HIGH 7.5
- TI-2024-36043 Trix vulnerable to Cross-site Scripting on copy & paste CVSS 4.0MEDIUM 5.1
- TI-2018-16075 easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in… CVSS 3.1MEDIUM 6.1
- TI-2024-22682 The Trix Editor Contains an Arbitrary Code Execution Vulnerability CVSS 3.1MEDIUM 5.4
- TI-2025-15570 Trix allows Cross-site Scripting via `javascript:` url in a link CVSS 3.1MEDIUM 5.3
- TI-2026-51546 Trix: Stored XSS via HTMLParser attribute injection on paste CVSS 3.1MEDIUM 4.6
Sources
- CVE-2024-43368 · CVE Program
- CVE-2024-43368 · NVD
- FIRST EPSS
- GHSA-qm2q-9f3q-2vcv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences