CVE-2024-53847

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-53847
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-53847.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-53847
Aliases
Published
2024-12-09T18:49:37.339Z
Modified
2026-03-01T02:53:04.805363Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Trix vulnerable to Cross-site Scripting on copy & paste
Details

The Trix rich text editor, prior to versions 2.1.9 and 1.3.3, is vulnerable to cross-site scripting (XSS) + mutation XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Users should upgrade to Trix editor version 2.1.9 or 1.3.3, which uses DOMPurify to sanitize the pasted content.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53847.json"
}
References

Affected packages

Git / github.com/basecamp/trix

Affected ranges

Type
GIT
Repo
https://github.com/basecamp/trix
Events
Introduced
8b0da7512306630d31dc953a7ec1963f104b5af1
Fixed
a69b46377749e826105394f9bfb91f19e7afee52
Database specific 
{
    "versions": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.1.9"
        }
    ]
}
Type
GIT
Repo
https://github.com/basecamp/trix
Events
Introduced
8d1e77fa715d99dd638637657a8ecffad4bdbfd3
Fixed
ab192a21404f9ee4eec99d84ea8471db6791b1ac
Database specific 
{
    "versions": [
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "1.3.3"
        }
    ]
}

Affected versions

1.*
1.0.0
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.3.0
1.3.1
1.3.2
2.*
2.1.3
v2.*
v2.0.0
v2.0.1
v2.0.10
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1.0
v2.1.1
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-53847.json"