CVE-2025-21610
1 advisory.
npm/trix CVE-2025-21610: medium 5.3
Trix allows Cross-site Scripting via `javascript:` url in a link
Action: Upgrade trix to 2.1.12 or later.
npm i trix@2.1.12Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.12 | - |
Fixed versions
| 2.1.12 |
Sources
- osv: GHSA-j386-3444-qgwg
- https://github.com/basecamp/trix/security/advisories/GHSA-j386-3444-qgwg
- https://nvd.nist.gov/vuln/detail/CVE-2025-21610
- https://github.com/basecamp/trix/commit/180c8d337f18e1569cea6ef29b4d03ffff5b5faa
- https://github.com/basecamp/trix/commit/c4f0d6f80654603932af6685694f694e96593b93
- https://gist.github.com/th4s1s/3921fd9c3e324ad9a3e0d846166e3eb8
- https://github.com/basecamp/trix
CVE-2025-21610 · published · modified · JSON