Skip to main content
cve.nowby Sazabi
← npm
npmPackage

trix

8 known vulnerabilities (6 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 6 medium, 2 low
Registry
npm

Advisories 8

  • CVE-2026-73426Medium 4.6

    Trix: Stored XSS vulnerability through serialized attributes

    Affected: fixed in 2.1.17.

  • CVE-2026-73428Medium 4.6

    Trix: Stored XSS via HTMLParser attribute injection on paste

    Affected: fixed in 2.1.18.

  • Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)

    Affected: fixed in 2.1.18.

  • Trix vulnerable to Cross-site Scripting on copy & paste

    Affected: fixed in 2.1.15.

  • CVE-2025-21610Medium 5.3

    Trix allows Cross-site Scripting via `javascript:` url in a link

    Affected: fixed in 2.1.12.

  • CVE-2024-53847Medium 5.1

    Trix vulnerable to Cross-site Scripting on copy & paste

    Affected: from 2.0.0, fixed in 2.1.9; from 1.0.0, fixed in 1.3.3.

  • CVE-2024-43368Medium 6.5

    Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste

    Affected: fixed in 2.1.4.

  • CVE-2024-34341Medium 5.4

    The Trix Editor Contains an Arbitrary Code Execution Vulnerability

    Affected: from 2.0.0, fixed in 2.1.1; from 0.9.0, fixed in 1.3.2.