CVE-2025-46812
LOW EPSS 44.3%
Published May 8, 20251y ago · Modified Jun 17, 20262w ago
2.0 CVSS 4.0
Published May 8, 2025 1y ago
Last Modified Jun 17, 2026 2w ago
Description
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.15 are vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. This issue has been patched in version 2.1.15.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction A
Scope X
Threat Intelligence
EPSS Exploit Probability
44.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-79 Cross-site Scripting Injection
References 2
- github.com https://github.com/basecamp/trix/commit/75226089646841b0f774d8b152e5ec27d2d9e191
- github.com https://github.com/basecamp/trix/security/advisories/GHSA-mcrw-746g-9q8h
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.