CVE-2025-21610 Trix allows Cross-site Scripting via `javascript:` url in a link
Attackers can execute arbitrary JavaScript via malicious javascript: URLs in links, potentially stealing data or hijacking sessions in applications using Trix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-21610?
CVE-2025-21610 is a medium-severity cross-site scripting vulnerability in basecamp trix, published on 3 Jan 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scripting when pasting malicious code in the link field. An attacker could trick the user to copy&paste a malicious `javascript:` URL as a link that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Users should upgrade to Trix editor version 2.1.12 or later to receive a patch. In addition to upgrading, affected users can disallow browsers that don't support a Content Security Policy (CSP) as a workaround for this and other cross-site scripting vulnerabilities. Set CSP policies such as script-src 'self' to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using script-src-elem.
Weakness: CWE-79
Which versions are affected by CVE-2025-21610?
2 open source packages ship an affected version, including trix.
| Package | Affected | Fixed in |
|---|---|---|
trix npm | All versions | 2.1.12 |
trix npm | All versions | 2.1.12 |
How do I fix CVE-2025-21610?
Upgrade trix to 2.1.12 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-21610 being exploited?
There is no known exploitation of CVE-2025-21610 in the wild and no public exploit code.
Sources
Also known as GHSA-j386-3444-qgwg.