https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 01:51:26 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-208914 EUVD-2026-208914 https://cve.radiocsirt.org/vuln/euvd-2026-208914 https://cve.radiocsirt.org/vuln/fkie_cve-2025-21610 <p>Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scripting when pasting malicious code in the link field. An attacker could trick the user to copy&amp;paste a malicious `javascript:` URL as a link that would execute arbitrary JavaScript code within the context of the user&#39;s session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Users should upgrade to Trix editor version 2.1.12 or later to receive a patch. In addition to upgrading, affected users can disallow browsers that don&#39;t support a Content Security Policy (CSP) as a workaround for this and other cross-site scripting vulnerabilities. Set CSP policies such as script-src &#39;self&#39; to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using script-src-elem.</p> <p>Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scripting when pasting malicious code in the link field. An attacker could trick the user to copy&amp;paste a malicious `javascript:` URL as a link that would execute arbitrary JavaScript code within the context of the user&#39;s session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Users should upgrade to Trix editor version 2.1.12 or later to receive a patch. In addition to upgrading, affected users can disallow browsers that don&#39;t support a Content Security Policy (CSP) as a workaround for this and other cross-site scripting vulnerabilities. Set CSP policies such as script-src &#39;self&#39; to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using script-src-elem.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-21610 https://cve.radiocsirt.org/vuln/ghsa-j386-3444-qgwg <p><strong>Affected:</strong> npm: trix</p> <p>The Trix editor, versions prior to 2.1.11, is vulnerable to XSS when pasting malicious code in the link field.</p> <p>### Impact</p> <p>An attacker could trick the user to copy&amp;paste a malicious `javascript:` URL as a link that would execute arbitrary JavaScript code within the context of the user&#39;s session, potentially leading to unauthorized actions being performed or sensitive information being disclosed.</p> <p>See https://gist.github.com/th4s1s/3921fd9c3e324ad9a3e0d846166e3eb8</p> <p>### Patches</p> <p>Update Recommendation: Users should upgrade to Trix editor version 2.1.12 or later.</p> <p>### Workarounds</p> <p>This is not really a workaround but something that should be considered in addition to upgrading to the patched version. If affected users can disallow browsers that don&#39;t support a Content Security Policy, then this would be an effective workaround for this and all XSS vulnerabilities. Set CSP policies such as script-src &#39;self&#39; to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using script-src-elem.</p> <p>### References</p> <p>https://gist.github.com/th4s1s/3921fd9c3e324ad9a3e0d846166e3eb8</p> <p>### Credits</p> <p>This vulnerability was reported by Hackerone researcher https://hackerone.com/lio346?type=user</p> <p><strong>Affected:</strong> npm: trix</p> <p>The Trix editor, versions prior to 2.1.11, is vulnerable to XSS when pasting malicious code in the link field.</p> <p>### Impact</p> <p>An attacker could trick the user to copy&amp;paste a malicious `javascript:` URL as a link that would execute arbitrary JavaScript code within the context of the user&#39;s session, potentially leading to unauthorized actions being performed or sensitive information being disclosed.</p> <p>See https://gist.github.com/th4s1s/3921fd9c3e324ad9a3e0d846166e3eb8</p> <p>### Patches</p> <p>Update Recommendation: Users should upgrade to Trix editor version 2.1.12 or later.</p> <p>### Workarounds</p> <p>This is not really a workaround but something that should be considered in addition to upgrading to the patched version. If affected users can disallow browsers that don&#39;t support a Content Security Policy, then this would be an effective workaround for this and all XSS vulnerabilities. Set CSP policies such as script-src &#39;self&#39; to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using script-src-elem.</p> <p>### References</p> <p>https://gist.github.com/th4s1s/3921fd9c3e324ad9a3e0d846166e3eb8</p> <p>### Credits</p> <p>This vulnerability was reported by Hackerone researcher https://hackerone.com/lio346?type=user</p> https://cve.radiocsirt.org/vuln/ghsa-j386-3444-qgwg