GHSA-mcrw-746g-9q8h: XSS
First published: Thu May 08 2025(Updated: )
### Impact The Trix editor, in versions prior to 2.1.15, is vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. ### Patches Update Recommendation: Users should upgrade to Trix editor version 2.1.15 or later. ### References The XSS vulnerability was reported by HackerOne researcher [hiumee](https://hackerone.com/hiumee?type=user).
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/trix | <2.1.15 | 2.1.15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of GHSA-mcrw-746g-9q8h?
GHSA-mcrw-746g-9q8h is classified as a high severity vulnerability due to its potential for XSS attacks.
How do I fix GHSA-mcrw-746g-9q8h?
To resolve GHSA-mcrw-746g-9q8h, upgrade the Trix editor to version 2.1.15 or later.
What type of attacks does GHSA-mcrw-746g-9q8h facilitate?
GHSA-mcrw-746g-9q8h facilitates cross-site scripting (XSS) attacks when a user pastes malicious code.
Who is affected by GHSA-mcrw-746g-9q8h?
Users of the Trix editor versions prior to 2.1.15 are affected by GHSA-mcrw-746g-9q8h.
What can happen if GHSA-mcrw-746g-9q8h is not addressed?
If GHSA-mcrw-746g-9q8h is not addressed, an attacker could execute arbitrary JavaScript code in the user's session, leading to potential unauthorized actions.
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/source
- agent/type
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- agent/tags
- agent/event
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-mcrw-746g-9q8h
- alias/CVE-2025-46812
- agent/software-canonical-lookup
- package-manager/npm