-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| trix | npm | < 2.1.16 | 2.1.16 |
| action_text-trix | rubygems | < 2.1.16 | 2.1.16 |
Miggo AIRoot Cause AnalysisThe vulnerability is a stored Cross-Site Scripting (XSS) issue in the Trix editor, specifically within the handling of attachment attributes. The analysis of the provided patch commit 73c20cf03ab2b56c0ef9c9b1aaf63f2de44f4010 reveals that the core of the vulnerability lies in the AttachmentView.getHref function. Before the patch, this function would retrieve the href attribute from an attachment and return it without validation. This allowed for malicious schemes like javascript: to be embedded in the attachment's data. The patch introduces a security control by using DOMPurify.isValidAttribute to sanitize the href attribute before it is returned, thus preventing the execution of arbitrary JavaScript. The test file src/test/unit/html_parser_test.js also confirms this by adding test cases that check for javascript: and data:text/html protocols in attachment hrefs. Therefore, the AttachmentView.getHref function is the primary vulnerable function that would appear in a runtime profile during the exploitation of this vulnerability.
AttachmentView.getHrefsrc/trix/views/attachment_view.js