CVE-2025-46812: falha de baixa gravidade em basecamp trix
Trix vulnerable to Cross-site Scripting on copy & paste
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 2epss 0.7%
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.15 are vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. This issue has been patched in version 2.1.15.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P
Produtos afetados
basecamp · trixCVEs relacionadas — basecamp trix
No mesmo produto, das mais perigosas para as menos.
CVE-2024-34341MEDIUMThe Trix Editor Contains an Arbitrary Code Execution VulnerabilityEPSS 0.8%CVE-2026-73427LOWTrix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)EPSS 0.6%CVE-2024-43368MEDIUMTrix has a Cross-Site Scripting (XSS) vulnerability on copy & pasteEPSS 0.5%CVE-2024-53847MEDIUMTrix vulnerable to Cross-site Scripting on copy & pasteEPSS 0.5%CVE-2025-21610MEDIUMTrix allows Cross-site Scripting via `javascript:` url in a linkEPSS 0.4%CVE-2026-73428MEDIUMTrix: Stored XSS via HTMLParser attribute injection on pasteEPSS 0.4%