CVE-2025-46812
Trix vulnerable to Cross-site Scripting on copy & paste
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.15 are vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. This issue has been patched in version 2.1.15.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Trix vulnerable to Cross-site Scripting on copy & paste
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.15 are vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. This issue has been patched in version 2.1.15.
- Record
CVE-2025-46812- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-14005
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.15 are vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. This issue has been patched in version 2.1.15.
- Record
EUVD-2025-14005- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mcrw-746g-9q8h
Trix vulnerable to Cross-site Scripting on copy & paste
Impact
The Trix editor, in versions prior to 2.1.15, is vulnerable to XSS attacks when pasting malicious code.
An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed.
Patches
Update Recommendation: Users should upgrade to Trix editor version 2.1.15 or later.
References
The XSS vulnerability was reported by HackerOne researcher hiumee.
- Record
GHSA-mcrw-746g-9q8h- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.15 are vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. This issue has been patched in version 2.1.15.
- Record
CVE-2025-46812- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Trix vulnerable to Cross-site Scripting on copy & paste
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.15 are vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. This issue has been patched in version 2.1.15.
- Record
CVE-2025-46812- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-mcrw-746g-9q8h
Trix vulnerable to Cross-site Scripting on copy & paste
Impact
The Trix editor, in versions prior to 2.1.15, is vulnerable to XSS attacks when pasting malicious code.
An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed.
Patches
Update Recommendation: Users should upgrade to Trix editor version 2.1.15 or later.
References
The XSS vulnerability was reported by HackerOne researcher hiumee.
- Record
GHSA-mcrw-746g-9q8h- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
trixnpm |
before 2.1.15 | 2.1.15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-46812 is a low vulnerability (CVSS 2.0) in Basecamp Trix, published May 8, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 53rd percentile. Fixed in trix 2.1.15.
References
github.com/basecamp/trix/security/advisories/GHSA-mcrw-746g-9q8h
nvd.nist.gov/vuln/detail/CVE-2025-46812