Trix vulnerabilities

Trix, a what-you-see-is-what-you-get rich text editor, prior to version 2.1.17 is vulnerable to cross-site scripting via a data-trix-serialized-attributes attribute that bypasses the DOMPurify sanitizer. An attacker can craft HTML with this attribute containing a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session, potentially leading to unauthorized actions or disclosure of sensitive information.

Trix prior to version 2.1.18 is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a <span> with an empty data-trix-attachment="{}" value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and execute when another user renders and clicks the content.

Trix prior to 2.1.18 is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without Input Events Level 2 support. The StringPiece.fromJSON method trusts href attributes from the JSON payload without sanitization, allowing a draggable element containing a javascript: URI to bypass DOMPurify sanitization and inject executable JavaScript into the DOM. Exploitation requires the victim to drag and drop attacker-controlled content, and server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.