CVE-2025-21610: basecamp trix Cross-site Scripting

Vulnerability summary

CVE-2025-21610 is a medium (CVSS 5.3) Cross-site Scripting vulnerability in basecamp trix. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35.1% of scored vulnerabilities.

Timeline

1. 03-01-2025
   PublishedVulnerability first disclosed.
2. 03-01-2025
   Last modifiedVulnerability information updated.

Description

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scripting when pasting malicious code in the link field. An attacker could trick the user to copy&paste a malicious `javascript:` URL as a link that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Users should upgrade to Trix editor version 2.1.12 or later to receive a patch. In addition to upgrading, affected users can disallow browsers that don't support a Content Security Policy (CSP) as a workaround for this and other cross-site scripting vulnerabilities. Set CSP policies such as script-src 'self' to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using script-src-elem.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.