GHSA-53p3-c7vp-4mcc — trix
Fix: basecamp/trix@9c0a993GHSA-53p3-c7vp-4mcc is a Cross-site Scripting (XSS) vulnerability in trix. A fix is available for trix — see the affected versions and patch details below.
Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-53p3-c7vp-4mcc.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
trixnpmDescription
Impact
The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when a crafted application/x-trix-document JSON payload is dropped into the editor in environments using the fallback Level0InputController (e.g., embedded WebViews lacking Input Events Level 2 support).
The StringPiece.fromJSON method trusted href attributes from the JSON payload without sanitization. An attacker could craft a draggable element containing a javascript: URI in the href attribute that, when dropped into a vulnerable editor, would bypass DOMPurify sanitization and inject executable JavaScript into the DOM.
Exploitation requires a specific environment (Level0InputController fallback) and social engineering (victim must drag and drop attacker-controlled content into the editor). Applications using server-side HTML sanitization (such as Rails' built-in sanitizer) are additionally protected, as the payload is neutralized on save.
Patches
Update Recommendation: Users should upgrade to Trix editor version 2.1.18 or later.
References
The XSS vulnerability was responsibly reported by Hackerone researcher newbiefromcoma.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | trix | all versions | 2.1.18npm install trix@2.1.18 |
| 💎RubyGems | action_text-trix | all versions | 2.1.18bundle update action_text-trix --conservative |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for trix, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update trix to 2.1.18 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-53p3-c7vp-4mcc is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
The version of action_text-trix shipped in Red Hat products is not affected by this vulnerability as it already includes the fix.
Upgrading to Trix 2.1.18+ resolves this issue. Applications using server-side HTML sanitization (such as Rails' built-in sanitizer) provide additional protection.Source: Red Hat security advisory for GHSA-53p3-c7vp-4mcc (CC BY 4.0)
Frequently Asked Questions
Is GHSA-53p3-c7vp-4mcc in your dependencies?
Find it across npm, RubyGems, including transitive dependencies.