CVE-2025-21610

creationtimestamp| type| source ---|---|--- 2025-01-03 16:41:27+00:00| seen| https://infosec.exchange/users/cve/statuses/113765416067424067 2025-01-03 18:41:40+00:00| seen| https://t.me/cvedetector/14230...

CVE-2025-21610

Trix is vulnerable to cross-site scripting (XSS) in versions prior to 2.1.12 when a user pastes a malicious javascript: URL into the link field. An attacker could entice a user to copy&paste such a link, causing arbitrary JavaScript execution in the user’s session. A patch exists in Trix v2.1.12 ...

CVE-2025-21610 Trix allows Cross-site Scripting via `javascript:` url in a link

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scripting when pasting malicious code in the link field. An attacker could trick the user to copy&paste a malicious javascript: URL as a link that would execute...