Basecamp / Trix
8 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-73426 | Trix: Stored XSS vulnerability through serialized attributes | MEDIUM | 4.6 | Aug 18, 2026 |
| CVE-2026-73428 | Trix: Stored XSS via HTMLParser attribute injection on paste | MEDIUM | 4.6 | Aug 13, 2026 |
| CVE-2026-73427 | Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController) | LOW | 2.1 | Aug 12, 2026 |
| CVE-2025-46812 | Trix vulnerable to Cross-site Scripting on copy & paste | LOW | 2.0 | May 8, 2025 |
| CVE-2025-21610 | Trix allows Cross-site Scripting via `javascript:` url in a link | MEDIUM | 5.3 | Jan 3, 2025 |
| CVE-2024-53847 | Trix vulnerable to Cross-site Scripting on copy & paste | MEDIUM | 5.1 | Dec 9, 2024 |
| CVE-2024-43368 | Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste | MEDIUM | 6.5 | Aug 14, 2024 |
| CVE-2024-34341 | The Trix Editor Contains an Arbitrary Code Execution Vulnerability | MEDIUM | 5.4 | May 7, 2024 |
Showing 1 to 8 of 8 CVEs