https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 11:15:58 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-158679 EUVD-2026-158679 https://cve.radiocsirt.org/vuln/euvd-2026-158679 https://cve.radiocsirt.org/vuln/fkie_cve-2024-43368 <p>The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in place for GHSA-qjqp-xr96-cj99. In pull request 1149, sanitation was added for Trix attachments with a `text/html` content type. However, Trix only checks the content type on the paste event&#39;s `dataTransfer` object. As long as the `dataTransfer` has a content type of `text/html`, Trix parses its contents and creates an `Attachment` with them, even if the attachment itself doesn&#39;t have a `text/html` content type. Trix then uses the attachment content to set the attachment element&#39;s `innerHTML`. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user&#39;s session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. This vulnerability was fixed in version 2.1.4.</p> <p>The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in place for GHSA-qjqp-xr96-cj99. In pull request 1149, sanitation was added for Trix attachments with a `text/html` content type. However, Trix only checks the content type on the paste event&#39;s `dataTransfer` object. As long as the `dataTransfer` has a content type of `text/html`, Trix parses its contents and creates an `Attachment` with them, even if the attachment itself doesn&#39;t have a `text/html` content type. Trix then uses the attachment content to set the attachment element&#39;s `innerHTML`. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user&#39;s session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. This vulnerability was fixed in version 2.1.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-43368 https://cve.radiocsirt.org/vuln/ghsa-qm2q-9f3q-2vcv <p><strong>Affected:</strong> npm: trix</p> <p>The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in place for https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99. In https://github.com/basecamp/trix/pull/1149, we added sanitation for Trix attachments with a `text/html` content type. However, Trix only checks the content type on the paste event&#39;s `dataTransfer` object. As long as the `dataTransfer` has a content type of `text/html`, Trix parses its contents and creates an `Attachment` with them, even if the attachment itself doesn&#39;t have a `text/html` content type. Trix then uses the attachment content to set the attachment element&#39;s `innerHTML`.</p> <p>### Impact An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user&#39;s session, potentially leading to unauthorized actions being performed or sensitive information being disclosed.</p> <p>### Patches **Update Recommendation:** Users should upgrade to Trix editor version 2.1.4 or later, which incorporates proper sanitization of input from copied content.</p> <p>### Workarounds This is not really a workaround but something that should be considered in addition to upgrading to the patched version. If affected users can disallow browsers that don&#39;t support a Content Security Policy, then this would be an effective workaround for this and all XSS vulnerabilities. Set CSP policies such as `script-src &#39;self&#39;`…</p> <p><strong>Affected:</strong> npm: trix</p> <p>The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in place for https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99. In https://github.com/basecamp/trix/pull/1149, we added sanitation for Trix attachments with a `text/html` content type. However, Trix only checks the content type on the paste event&#39;s `dataTransfer` object. As long as the `dataTransfer` has a content type of `text/html`, Trix parses its contents and creates an `Attachment` with them, even if the attachment itself doesn&#39;t have a `text/html` content type. Trix then uses the attachment content to set the attachment element&#39;s `innerHTML`.</p> <p>### Impact An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user&#39;s session, potentially leading to unauthorized actions being performed or sensitive information being disclosed.</p> <p>### Patches **Update Recommendation:** Users should upgrade to Trix editor version 2.1.4 or later, which incorporates proper sanitization of input from copied content.</p> <p>### Workarounds This is not really a workaround but something that should be considered in addition to upgrading to the patched version. If affected users can disallow browsers that don&#39;t support a Content Security Policy, then this would be an effective workaround for this and all XSS vulnerabilities. Set CSP policies such as `script-src &#39;self&#39;`…</p> https://cve.radiocsirt.org/vuln/ghsa-qm2q-9f3q-2vcv