# Mutation Based Stored XSS on Trix Editor version latest (2.1.8)

Trix Editor's sanitizer is bypassed via a MathML mutation XSS payload smuggled through a copy-paste data-trix-attachment, executing arbitrary JS in the user's session.

- Payout: hidden
- Severity: critical
- Program: Basecamp
- Found by: sudi
- Disclosed: 2025-06-27
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2819573
- Library page: https://bugbountylibrary.com/r/h1%3A2819573
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:critical tech:nodejs technique:parser-differential vuln:xss

**Target:** Trix rich-text editor (trix-editor web component) sanitizer
**Root cause:** Trix's HTML sanitizer does not account for MathML mutation behavior where the parser reinterprets <style> content, allowing an <img onerror> to survive sanitization and execute.
**Steps:**
1. Host an HTML page loading trix@2.1.8 UMD.
2. Write a div with data-trix-attachment JSON whose content is `<math><mtext><table><mglyph><style><img src=x onerror=alert()></style>XSS POC`.
3. Copy the surrounding text (`copy me`) and paste into the trix-editor.
4. Sanitizer processes the attachment content, mutation reinterprets it, and `alert()` fires.
**How found:** Researcher referenced a known MathML mutation XSS bypass of DOMPurify and hypothesized Trix's sanitizer would be similarly vulnerable to mutation-based vectors delivered via copy-paste attachments.
**Exploitation:** Attacker crafts content containing a data-trix-attachment with malicious HTML5 content; when a victim copies and pastes it into a Trix editor, the sanitizer is bypassed and JS executes in the victim's session, enabling unauthorized actions or data disclosure.
**Insight:** When a rich-text editor sanitizes pasted attachment HTML, test MathML mutation vectors (`<math><mtext><table><mglyph><style>`) that reparse into executable tags; the data-trix-attachment JSON content field is a viable smuggling channel.