4.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-qmpg-8xg6-ph5q

GHSA-qmpg-8xg6-ph5q: Trix has a Stored XSS vulnerability through serialized attributes

Impact

The Trix editor, in versions prior to 2.1.17, is vulnerable to XSS attacks when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer.

An attacker could craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when the content is rendered, could execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed.

Patches

Update Recommendation: Users should upgrade to Trix editor version 2.1.17 or later.

References

The XSS vulnerability was responsibly reported by Hackerone researcher newbiefromcoma.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-qmpg-8xg6-ph5q

GHSA-qmpg-8xg6-ph5q:

4.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
action_text-trix	rubygems	< 2.1.17	2.1.17
trix	npm	< 2.1.17	2.1.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) weakness in the Trix editor, identified as GHSA-qmpg-8xg6-ph5q. The root cause is the improper sanitization of HTML content, specifically the failure to remove the data-trix-serialized-attributes attribute. An attacker could embed a malicious payload within this attribute.

The analysis of the patch commit 53197ab5a142e6b0b76127cb790726b274eaf1bc reveals that the fix involves adding a hook to the DOMPurify library. This hook, uponSanitizeAttribute, now explicitly checks for and removes the data-trix-serialized-attributes attribute during the sanitization process.

The primary function that orchestrates this sanitization is HTMLSanitizer.sanitize. Before the patch, a call to this function with malicious HTML would result in an output that is not properly sanitized, as it would still contain the dangerous attribute. Subsequent processing of this content by the Trix editor would deserialize the attribute's value and apply it to DOM elements, triggering the XSS payload.

Therefore, HTMLSanitizer.sanitize is the key vulnerable function. It would appear in a runtime profile or stack trace during the initial processing of the malicious content. The fix was applied to the source file src/trix/models/html_sanitizer.js for the trix npm package and the corresponding bundled file action_text-trix/app/assets/javascripts/trix.js for the action_text-trix RubyGem.

Vulnerable functions

HTMLSanitizer.sanitize

src/trix/models/html_sanitizer.js

This function is responsible for sanitizing HTML content within the Trix editor. It utilizes the DOMPurify library, but prior to the patch, it was misconfigured. It failed to remove the `data-trix-serialized-attributes` attribute, which could contain a malicious payload. When this 'sanitized' HTML was later processed, the content of this attribute was used to create new HTML elements, and attributes from the JSON payload were applied directly to the element without further sanitization, leading to a stored XSS vulnerability. The `sanitize` function is the entry point for this flawed sanitization process.

HTMLSanitizer.sanitize

action_text-trix/app/assets/javascripts/trix.js

This function, found in the bundled JavaScript for the `action_text-trix` gem, is responsible for sanitizing HTML content. It uses DOMPurify but was misconfigured to allow the `data-trix-serialized-attributes` attribute. This allowed an attacker to inject a malicious payload that would be executed when the content was rendered, leading to a stored XSS vulnerability. This function is the entry point for the flawed sanitization logic within the Ruby on Rails Action Text integration.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.