CVE-2025-21610

creationtimestamp| type| source ---|---|--- 2025-01-03 16:41:27+00:00| seen| https://infosec.exchange/users/cve/statuses/113765416067424067 2025-01-03 18:41:40+00:00| seen| https://t.me/cvedetector/14230...

lesli-vue (>=1.0.1, <=1.0.3) potentially affected by CVE-2025-21610 via trix (>=2.0.8, <=2.0.10)

trix NPM version =2.0.8, =1.0.1, =1.0.3 Source cves: CVE-2025-21610 Source advisory: OSV:GHSA-J386-3444-QGWG...

CVE-2025-21610

Trix is vulnerable to cross-site scripting (XSS) in versions prior to 2.1.12 when a user pastes a malicious javascript: URL into the link field. An attacker could entice a user to copy&paste such a link, causing arbitrary JavaScript execution in the user’s session. A patch exists in Trix v2.1.12 ...

CVE-2025-21610 Trix allows Cross-site Scripting via `javascript:` url in a link

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scripting when pasting malicious code in the link field. An attacker could trick the user to copy&paste a malicious javascript: URL as a link that would execute...