Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

basecamp/trix

              main @ 23ab2f6
            

Fixes

CVEs

HIGH

Peak severity

33.3%

Coverage

Highlights

Reflected XSS: 8 prior fixes. Scrutinize any change in this area.

src/trix/models/html_sanitizer.js: most-fixed (4 issues). Treat as high-risk during review.

9 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Reflected XSS: Pasting malicious HTML repeatedly bypasses the sanitizer. Standard sanitization configuration must strictly forbid dangerous tags like noscript, form, and iframe, and leverage DOMPurify configurations such as SAFE_FOR_XML to resist mutation-based XSS (mXSS).

Stored XSS: Unsanitized storage and retrieval of arbitrary HTML in container elements or custom `data-trix-*` serialized attributes can result in Stored XSS if attributes are parsed and later bound to live DOM nodes without re-sanitizing.

DOM-Based XSS: Deserializing JSON string pieces during drag-and-drop operations allows attackers to insert dangerous attributes, such as malicious `href` schemes, bypassing standard rendering guards.