https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 22:25:15 +0000 https://cve.radiocsirt.org/vuln/cve-2025-21610 <p><strong>Affected:</strong> basecamp trix</p> <p>Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scripting when pasting malicious code in the link field. An attacker could trick the user to copy&amp;paste a malicious `javascript:` URL as a link that would execute arbitrary JavaScript code within the context of the user&#39;s session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Users should upgrade to Trix editor version 2.1.12 or later to receive a patch. In addition to upgrading, affected users can disallow browsers that don&#39;t support a Content Security Policy (CSP) as a workaround for this and other cross-site scripting vulnerabilities. Set CSP policies such as script-src &#39;self&#39; to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using script-src-elem.</p> <p><strong>Affected:</strong> basecamp trix</p> <p>Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scripting when pasting malicious code in the link field. An attacker could trick the user to copy&amp;paste a malicious `javascript:` URL as a link that would execute arbitrary JavaScript code within the context of the user&#39;s session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Users should upgrade to Trix editor version 2.1.12 or later to receive a patch. In addition to upgrading, affected users can disallow browsers that don&#39;t support a Content Security Policy (CSP) as a workaround for this and other cross-site scripting vulnerabilities. Set CSP policies such as script-src &#39;self&#39; to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using script-src-elem.</p> https://cve.radiocsirt.org/vuln/cve-2025-21610