Cross-Site Scripting Vulnerability in Trix Text Editor by Basecamp
CVE-2025-21610
What is CVE-2025-21610?
The Trix text editor, developed by Basecamp, is susceptible to cross-site scripting vulnerabilities due to improper handling of user inputs within the link field. Specifically, versions prior to 2.1.12 allow attackers to exploit this weakness by manipulating users into copying and pasting malicious 'javascript:' URLs. This can lead to unauthorized actions being executed within the user's session context, potentially compromising sensitive information. To safeguard against this vulnerability, users are strongly advised to update to Trix version 2.1.12 or later. Additionally, implementing a strict Content Security Policy (CSP), such as setting 'script-src 'self'', can mitigate potential risks associated with this type of attack, by only permitting scripts from the same origin and prohibiting inline scripts.