CVE-2025-21610

Summary

CVE-2025-21610 is a cross-site scripting (XSS) vulnerability affecting versions of the Trix rich text editor prior to 2.1.12. Malicious JavaScript code could be executed in user sessions by tricking them into pasting a malicious `javascript:` URL as a link. This could potentially result in unauthorized actions or sensitive information disclosure. To mitigate the risk, users are advised to upgrade to Trix editor version 2.1.12 or later. Additionally, implementing a Content Security Policy (CSP) with a strict script-src directive, such as 'self', and explicitly prohibiting inline scripts using script-src-elem can serve as a workaround for this and other XSS vulnerabilities.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.