CVE-2025-46812

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-46812
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-46812.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-46812
Aliases
Published
2025-05-08T19:27:22.573Z
Modified
2026-04-10T05:28:33.256935Z
Severity
  • 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P CVSS Calculator
Summary
Trix vulnerable to Cross-site Scripting on copy & paste
Details

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.15 are vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. This issue has been patched in version 2.1.15.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46812.json"
}
References

Affected packages

Git / github.com/basecamp/trix

Affected ranges

Type
GIT
Repo
https://github.com/basecamp/trix
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5f8d56dca618d6f51d9b86f5983c3490dd6588ea

Affected versions

0.*
0.10.0
0.10.1
0.10.2
0.11.0
0.11.1
0.11.2
0.11.3
0.11.4
0.12.0
0.12.1
0.5.0
0.8.0
0.9.0
0.9.1
0.9.10
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
1.*
1.0.0
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.3.0
1.3.1
2.*
2.1.3
v2.*
v2.0.1
v2.0.10
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1.0
v2.1.1
v2.1.10
v2.1.11
v2.1.12
v2.1.13
v2.1.14
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-46812.json"