Back to security portal
Reflected cross-site scripting (XSS) vulnerability on connect.trezor.io via hash fragment script injection
Reported on March 25, 2026
A vulnerability was discovered in the documentation endpoint of Trezor Connect, where a URL parameter could be abused to load and execute arbitrary JavaScript within the trusted domain. This issue resulted in a reflected cross-site scripting (XSS) vulnerability, allowing malicious scripts to run in the context of the official site.
Reported by Vipul Sahu
Resolved vulnerabilities
Reported by the community. Investigated. Resolved. Because your security is never optional.
- Open redirect on affiliate pageMarch 20, 2026
- Biometric Verification bypassed in Trezor Suite with external monitorMarch 9, 2026
- Insufficient entropy on Trezor Model One with 12/18 wordsFebruary 6, 2026
- Bug in multisig verificationJanuary 10, 2026
- Inability to cancel certain flows on pre-production firmwareOctober 31, 2025
- Fix side-channel in BIP-39 mnemonic processing when unlockedSeptember 24, 2025