npm/trix CVE-2024-43368: medium 6.5, EPSS 0.52%

Trix has a cross-site Scripting vulnerability on copy & paste

Action: Upgrade trix to 2.1.4 or later.

npm i trix@2.1.4

Affected

Fixed versions

Sources

• osv: GHSA-qm2q-9f3q-2vcv
• https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99
• https://github.com/basecamp/trix/security/advisories/GHSA-qm2q-9f3q-2vcv
• https://nvd.nist.gov/vuln/detail/CVE-2024-43368
• https://github.com/basecamp/trix/pull/1149
• https://github.com/basecamp/trix/pull/1156
• https://github.com/basecamp/trix/commit/7656f578af0d03141a72a9d27cb3692e6947dae6
• https://developer.mozilla.org/en-US/docs/Web/API/DataTransfer
• https://github.com/basecamp/trix
• https://github.com/basecamp/trix/releases/tag/v2.1.4

CVE-2024-43368 · published 2024-08-14T18:11:53Z · modified 2026-02-04T02:40:03.643533Z · JSON