CyberRota Analysis
AI-GeneratedThe Trix rich text editor prior to version 2.1.17 is vulnerable to cross-site scripting (XSS) due to improper sanitization of the data-trix-serialized-attributes attribute, allowing attackers to execute arbitrary JavaScript in users' sessions. This vulnerability can lead to unauthorized actions or exposure of sensitive information. Organizations using affected versions of Trix should prioritize upgrading to version 2.1.17 to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session and may perform unauthorized actions or disclose sensitive information. This issue is fixed in version 2.1.17.