CVE-2024-34341 json
The Trix Editor Contains an Arbitrary Code Execution Vulnerability
published 2y ago modified 4mo ago also GHSA-qjqp-xr96-cj99 , EUVD-2024-1747
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application. Users should upgrade to Trix editor version 2.1.1 or later, which incorporates proper sanitization of input from copied content.
Patch / fix
- npm trix 1.3.2, 2.1.1
- rubygems actiontext 7.0.8.3, 7.1.3.3
- basecamp trix 2.1.1
- rubygem-actiontext-7.0 openSUSE Tumbleweed 7.0.8.6-1.3
- rubygem-rails-7.0 openSUSE Tumbleweed 7.0.8.6-1.3
- rubygem-actiontext-7.0 openSUSE Tumbleweed 7.0.8.4-1.1
- rubygem-rails-7.0 openSUSE Tumbleweed 7.0.8.4-1.1
opensuse advisories openSUSE-SU-2025:15111-1openSUSE-SU-2025:15124-1openSUSE-SU-2024:14068-1openSUSE-SU-2024:14074-1
- github.com/basecamp/trix@1a5c68a commit
- github.com/basecamp/trix@841ff19 commit
- github.com/rails/rails@07e6c88 commit
- github.com/rails/rails@260cb39 commit
- github.com/rails/rails@73fac32 commit
- github.com/basecamp/trix#1147 pull request
- github.com/basecamp/trix#1149 pull request
- github.com/basecamp/trix/releases/tag/v2.1.1 release
Is CVE-2024-34341 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
0.78% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | trix | >=2.0.0, <2.1.1 >=0.9.0, <1.3.2 |
2.1.1 1.3.2 |
| rubygems | actiontext | >=7.0.0.alpha1, <7.0.8.3 >=7.1.0.beta1, <7.1.3.3 |
7.0.8.3 7.1.3.3 |
Affected products
- basecamp trix
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/basecamp/trix/pull/1147
web
-
github.com
/basecamp/trix/pull/1149
web
-
github.com
/basecamp/trix/commit/1a5c68a14d48421fc368e30026f4a7918028b7ad
web
-
github.com
/basecamp/trix/commit/841ff19b53f349915100bca8fcb488214ff93554
web
-
github.com
/rails/rails/commit/07e6c88cc4defe6f6b8d28e79eb13a518e15b14c
web
-
github.com
/rails/rails/commit/260cb392fc1ee91d0b749cff08d1c8d54b230bd3
web
-
github.com
/rails/rails/commit/73fac32511eefdd45d8f00fecc2b8cc5408ea6d5
web
-
github.com
/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99
web
-
github.com
/basecamp/trix/releases/tag/v2.1.1
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-34341
advisory
-
discuss.rubyonrails.org
/t/xss-vulnerabilities-in-trix-editor/85803
web
-
github.com
/basecamp/trix
package
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/actiontext/CVE-2024-34341.yml
web
-
rubyonrails.org
/2024/5/17/Rails-Versions-7-0-8-2-and-7-1-3-3-have-been-released
web
-
rubyonrails.org
/2024/5/17/Rails-Versions-7-0-8-3-has-been-released
web
Sources
- CVE List CVE-2024-34341
- GitHub Advisory GHSA-qjqp-xr96-cj99
- NVD CVE-2024-34341
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.