Trix allows Cross-site Scripting via `javascript:` url in a link
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scripting when pasting malicious code in the link field. An attacker could trick the user to copy&paste a malicious `javascript:` URL as a link that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Users should upgrade to Trix editor version 2.1.12 or later to receive a patch. In addition to upgrading, affected users can disallow browsers that don't support a Content Security Policy (CSP) as a workaround for this and other cross-site scripting vulnerabilities. Set CSP policies such as script-src 'self' to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using script-src-elem.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| basecamp | trix | before 2.1.12 | 2.1.12 | Patch available | CNA |
| — | trix (npm) | before 2.1.12 | 2.1.12 | Patch available | GHSA-j386-3444-qgwg |
- trix Vendorbasecamp Affected before 2.1.12 Fixed in 2.1.12 Patch available CNA
- trix (npm) Vendor— Affected before 2.1.12 Fixed in 2.1.12 Patch available GHSA-j386-3444-qgwg
Remediation
- Fix · CNA trix (basecamp) Fixed in 2.1.12
- Fix · GHSA-j386-3444-qgwg trix (npm) Fixed in 2.1.12 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-21610
- 2026-10-03 Alias added: GHSA-j386-3444-qgwg
References
Other 5
- https://github.com/basecamp/trix/security/advisories/GHSA-j386-3444-qgwg
- https://github.com/basecamp/trix/commit/180c8d337f18e1569cea6ef29b4d03ffff5b5faa
- https://github.com/basecamp/trix/commit/c4f0d6f80654603932af6685694f694e96593b93
- https://gist.github.com/th4s1s/3921fd9c3e324ad9a3e0d846166e3eb8
- https://github.com/basecamp/trix
More basecamp vulnerabilities
- TI-2023-18436 Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1… CVSS 3.1HIGH 7.5
- TI-2024-29019 Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste CVSS 3.1MEDIUM 6.5
- TI-2024-36043 Trix vulnerable to Cross-site Scripting on copy & paste CVSS 4.0MEDIUM 5.1
- TI-2018-16075 easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in… CVSS 3.1MEDIUM 6.1
- TI-2024-22682 The Trix Editor Contains an Arbitrary Code Execution Vulnerability CVSS 3.1MEDIUM 5.4
- TI-2026-51546 Trix: Stored XSS via HTMLParser attribute injection on paste CVSS 3.1MEDIUM 4.6
Sources
- CVE-2025-21610 · CVE Program
- CVE-2025-21610 · NVD
- FIRST EPSS
- GHSA-j386-3444-qgwg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences