CVE-2025-46812 - CVE House
Back to Database
Status published Low CVE-2025-46812

Trix vulnerable to Cross-site Scripting on copy & paste

Vulnerability Description

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.15 are vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. This issue has been patched in version 2.1.15.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-46812

Credits & Attribution

No credits recorded in the NVD database.

References

More from basecamp

View All →
CVE-2025-58067
Basecamp's Google Sign-In for Rails allowed redirects to protocol-relative URI
Medium 4.2
CVE-2025-57821
Basecamp's Google Sign-In for Rails allowed redirects to a malformed URL
Medium 4.2
CVE-2025-21610
Trix allows Cross-site Scripting via `javascript:` url in a link
Medium 5.3
CVE-2024-53847
Trix vulnerable to Cross-site Scripting on copy & paste
Medium 5.1
CVE-2024-43368
Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste
Medium 6.5

Affected Vendor

Affected Software

trix
Vulnerable Versions:
< 2.1.15

Timeline

Official Publish: May 8th, 2025
Last Modified: May 8th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact