CVE-2024-34341— The Trix Editor Contains an Arbitrary Code Execution Vulnerability
Quick assessment
Affected
basecamp trix
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Trix是Basecamp开源的一个适用于日常写作的丰富文本编辑器。 Trix 2.1.1之前版本存在安全漏洞，该漏洞源于对粘贴内容的不当清理。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-34341
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
The Trix Editor Contains an Arbitrary Code Execution Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application. Users should upgrade to Trix editor version 2.1.1 or later, which incorporates proper sanitization of input from copied content.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Trix 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Trix是Basecamp开源的一个适用于日常写作的丰富文本编辑器。 Trix 2.1.1之前版本存在安全漏洞，该漏洞源于对粘贴内容的不当清理。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-34341
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-34341
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-34341 (3)
-
https://github.com/basecamp/trix/pull/1147 x_refsource_MISC
-
https://github.com/basecamp/trix/pull/1149 x_refsource_MISC
Vendor Advisories for CVE-2024-34341 (1)
-
https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99 x_refsource_CONFIRM
Other References for CVE-2024-34341 (1)
-
https://github.com/basecamp/trix/releases/tag/v2.1.1 x_refsource_MISC
IV. Related Vulnerabilities
Same product: trix
-
CVE-2026-73426
Trix: Stored XSS vulnerability through serialized attributes -
CVE-2026-73428
Trix: Stored XSS via HTMLParser attribute injection on paste -
CVE-2026-73427
Trix: XSS via JSON deserialization bypass in drag-and-drop ( -
CVE-2025-46812
Trix vulnerable to Cross-site Scripting on copy & paste -
CVE-2025-21610
Trix allows Cross-site Scripting via `javascript:` url in a
Same vendor: basecamp
-
CVE-2026-73426
Trix: Stored XSS vulnerability through serialized attributes -
CVE-2026-73428
Trix: Stored XSS via HTMLParser attribute injection on paste -
CVE-2026-73427
Trix: XSS via JSON deserialization bypass in drag-and-drop ( -
CVE-2025-58067
Basecamp's Google Sign-In for Rails allowed redirects to pro -
CVE-2025-57821
Basecamp's Google Sign-In for Rails allowed redirects to a m
Same weakness: CWE-79
-
CVE-2026-104393
WordPress Happy Addons for Elementor plugin <= 3.50.0 - Cros -
CVE-2026-105875
WordPress Prime Slider – Addons For Elementor plugin <= 4.6. -
CVE-2026-104391
WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Si -
CVE-2026-105884
WordPress Rocket Lazy Load plugin <= 2.4.0 - Cross Site Scri -
CVE-2026-105873
WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cr
V. Comments for CVE-2024-34341
No comments yet