CVE-2024-43368

What it actually does

Trix versions before 2.1.4 allow cross-site scripting on paste because sanitation for text/html attachments (the GHSA-qjqp-xr96-cj99 fix) inspects only the paste event dataTransfer content type, not the Attachment’s own type. If dataTransfer is text/html, Trix parses the clipboard HTML, creates an Attachment, and assigns that markup to the attachment element’s innerHTML, so attacker-controlled script runs in the application origin and the user’s session. Impact is confidentiality-focused (CVSS 6.5, UI:R); integrity and availability are not directly scored.

Why it matters to the business

Staff or customers who paste untrusted content into Trix-backed editors can have session data exposed or in-app actions taken in their name, undermining trust in comments, documents, CMS, and support workflows. User interaction is required, exploit maturity is none, EPSS is low and flat (~0.005 over 30 days), and the CVE is not in CISA KEV, so mass opportunistic risk is limited; residual exposure remains wherever unpatched or vendored Trix has lingered since the August 2024 disclosure.

How an attack unfolds

An attacker prepares HTML meant to run in the browser and places it where a target will copy it (a page, message, or document). The victim pastes into a Trix editor. Trix trusts a dataTransfer content type of text/html, builds an Attachment from the clipboard HTML even when the attachment itself is not typed text/html, and writes that HTML into the attachment node via innerHTML. Script then executes as the victim and can read information visible in the session or perform unauthorized actions. This bypasses the earlier attachment sanitation. No named threat actors, KEV use, or ransomware campaigns are associated.

How to fix it

Upgrade Trix to 2.1.4 or later (upstream fix 9579e33ae8542ad67b5c072f38eaf04ab8c5492f). Rebuild and redeploy any app that vendors, bundles, or CDN-loads trix so runtime assets match 2.1.4+. Prefer a Content-Security-Policy that blocks inline script as defense in depth, and do not assign untrusted paste HTML to innerHTML outside the patched editor.

How to confirm the fix worked

Confirm lockfiles, package manifests, and shipped static assets report Trix 2.1.4 or newer (or commit 9579e33). In a non-production build, paste HTML whose attachment type is not text/html while dataTransfer is text/html and confirm attachment nodes are not given unsanitized HTML. Re-scan stored rich-text records and CSP reports after rollout.

Typical attack path

1. Attacker prepares HTML and delivers it through a copy-friendly channel (web page, message, or document)
2. Victim copies that content
3. Victim pastes into a Trix rich-text control
4. Trix accepts dataTransfer as text/html, creates an Attachment, and sets the attachment element innerHTML
5. Injected script runs in the victim’s origin and authenticated session
6. Attacker-controlled code reads session-visible data or triggers in-app actions as the user

How to detect it

Exploitation is a victim paste in the browser, so servers rarely log a unique request. Review stored Trix/HTML document bodies and attachment metadata for unexpected script elements, javascript URLs, or event-handler attributes introduced around paste or edit activity. Correlate CSP violation reports, browser error telemetry, and session-audit trails for anomalous authenticated actions immediately after rich-text edits. No named actors or campaign infrastructure are tied to this CVE; treat findings as opportunistic XSS, not a known intrusion set.

What your security team should do

• Inventory applications and front-end bundles that include Trix and flag versions below 2.1.4, including vendored copies
• Upgrade to Trix 2.1.4+ and redeploy static assets so browsers cannot cache the old editor
• Enforce CSP that disallows unsafe-inline script to reduce XSS blast radius
• Hunt persisted Trix/HTML bodies and attachment metadata for unexpected script or event-handler markup
• Remind users not to paste content from untrusted sources into internal editors until patches are complete