The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application.
This vulnerability has been assigned the CVE identifier CVE-2024-34341.
Rails >= 7.0 embeds the Trix editor in the actiontext gem to be used with the Sprockets assets pipeline, so new releases of Rails with fixed versions of Trix are now available.
Rails 6.1 doesn’t embed the Trix editor.
Applications using Rails >= 6.1 and not using the Sprockets assets pipeline are recommend to upgrade the Trix package using the JavaScript packager manager to one of the fixed versions.
Versions Affected: >= 7.0.0. Not affected: < 7.0.0 Fixed Versions: 7.1.3.3, 7.0.8.2
Releases
The fixed releases are available at the normal locations.
Impact:
An attacker could exploit these vulnerabilities to execute arbitrary JavaScript code within the context of the user’s session, potentially leading to unauthorized actions being performed or sensitive information being disclosed.
Workarounds:
CSP Enhancement: Additionally, enhancing the Content Security Policy (CSP) to disallow inline scripts can significantly mitigate the risk of such vulnerabilities. Set CSP policies such as script-src ‘self’ to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using script-src-elem.
Credit
These issues were reported by security researchers loknop and pinpie.