CVE-2025-46812: Trix vulnerable to Cross-site Scripting on copy & paste
First published: Thu May 08 2025(Updated: )
### Impact The Trix editor, in versions prior to 2.1.15, is vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. ### Patches Update Recommendation: Users should upgrade to Trix editor version 2.1.15 or later. ### References The XSS vulnerability was reported by HackerOne researcher [hiumee](https://hackerone.com/hiumee?type=user).
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/trix | <2.1.15 | 2.1.15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-46812?
CVE-2025-46812 is considered a high-severity vulnerability due to its potential for XSS attacks.
How do I fix CVE-2025-46812?
To fix CVE-2025-46812, upgrade the Trix editor to version 2.1.15 or later.
What types of attacks are possible with CVE-2025-46812?
CVE-2025-46812 allows attackers to execute arbitrary JavaScript within the user's session through XSS attacks.
Which versions of Trix are affected by CVE-2025-46812?
CVE-2025-46812 affects Trix editor versions prior to 2.1.15.
Who is impacted by CVE-2025-46812?
Users of Trix editor versions before 2.1.15 are at risk of exploitation due to CVE-2025-46812.
- agent/weakness
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/type
- agent/description
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/event
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-mcrw-746g-9q8h
- alias/CVE-2025-46812
- agent/software-canonical-lookup
- agent/references
- agent/last-modified-date
- collector/nvd-cve
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- package-manager/npm