{"action":"Upgrade trix to 2.1.12 or later.","affected":[{"fixed":"2.1.12","introduced":"0"}],"component":"trix","cve_ids":["CVE-2025-21610"],"ecosystem":"npm","epss":0.00421,"exploited":false,"fixed_versions":["2.1.12"],"ghsa_id":"GHSA-j386-3444-qgwg","id":"tcs_01M5KFWN3JYPD1HHAE0F5P26QC","modified_at":"2025-01-03T19:26:14Z","published_at":"2025-01-03T16:29:58Z","references":["https://osv.dev/vulnerability/GHSA-j386-3444-qgwg","https://github.com/basecamp/trix/security/advisories/GHSA-j386-3444-qgwg","https://nvd.nist.gov/vuln/detail/CVE-2025-21610","https://github.com/basecamp/trix/commit/180c8d337f18e1569cea6ef29b4d03ffff5b5faa","https://github.com/basecamp/trix/commit/c4f0d6f80654603932af6685694f694e96593b93","https://gist.github.com/th4s1s/3921fd9c3e324ad9a3e0d846166e3eb8","https://github.com/basecamp/trix"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-j386-3444-qgwg","url":"https://osv.dev/vulnerability/GHSA-j386-3444-qgwg"}],"summary":"Trix allows Cross-site Scripting via `javascript:` url in a link"}