Lucene search

CVE-2025-21610 Trix allows Cross-site Scripting via `javascript:` url in a link

🗓️ 03 Jan 2025 16:54:29Reported by GitHub_MType

Trix editor vulnerable to Cross-site Scripting via JavaScript URLs. Upgrade to version 2.1.12.

Reporter	Title	Published	Views	Family All 5
NVD	CVE-2025-21610	3 Jan 202517:15	–	nvd
OSV	Trix allows Cross-site Scripting via `javascript:` url in a link	3 Jan 202516:29	–	osv
Github Security Blog	Trix allows Cross-site Scripting via `javascript:` url in a link	3 Jan 202516:29	–	github
CVE	CVE-2025-21610	3 Jan 202517:15	–	cve
Cvelist	CVE-2025-21610 Trix allows Cross-site Scripting via `javascript:` url in a link	3 Jan 202516:29	–	cvelist

Source	Link
github	www.github.com/basecamp/trix/commit/c4f0d6f80654603932af6685694f694e96593b93
gist	www.gist.github.com/th4s1s/3921fd9c3e324ad9a3e0d846166e3eb8
github	www.github.com/basecamp/trix/security/advisories/GHSA-j386-3444-qgwg
github	www.github.com/basecamp/trix/commit/180c8d337f18e1569cea6ef29b4d03ffff5b5faa

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

03 Jan 2025 16:29Current

6.5Medium risk

Vulners AI Score6.5

CVSS35.3

EPSS0.0004

SSVC

CWE-79