basecamp/trix Security Advisories | GitStock

medium2026-07-24

Trix: Stored XSS via HTMLParser attribute injection on paste

GHSA-53g2-mvcc-q9x3 · CVE-2026-73428

low2026-03-29

Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)

GHSA-53p3-c7vp-4mcc · CVE-2026-73427

medium2026-03-12

Trix has a Stored XSS vulnerability through serialized attributes

GHSA-qmpg-8xg6-ph5q · CVE-2026-73426

medium2025-12-31

Trix has a stored XSS vulnerability through its attachment attribute

GHSA-g9jg-w8vm-g96v

low2025-05-08

Trix vulnerable to Cross-site Scripting on copy & paste

GHSA-mcrw-746g-9q8h · CVE-2025-46812

medium2025-01-03

Trix allows Cross-site Scripting via `javascript:` url in a link

GHSA-j386-3444-qgwg · CVE-2025-21610

medium2024-12-09

Trix editor subject to XSS vulnerabilities on copy & paste

GHSA-6vx4-v2jw-qwqh · CVE-2024-53847

medium2024-08-14

Trix has a cross-site Scripting vulnerability on copy & paste

GHSA-qm2q-9f3q-2vcv · CVE-2024-43368

medium2024-05-07

Trix Editor Arbitrary Code Execution Vulnerability

GHSA-qjqp-xr96-cj99 · CVE-2024-34341