CVE-2026-73428
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Trix prior to version 2.1.18 is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a <span> with an empty data-trix-attachment="{}" value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and execute when another user renders and clicks the content.
Risk Assessment
An attacker can inject malicious scripts that execute in other users' browsers, potentially leading to session theft, content modification, or other damage.
Recommendation
Update Trix to version 2.1.18 or later. Apply server-side HTML sanitization to neutralize the payload.
Original NVD description (English source)
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `<span>` with an empty `data-trix-attachment="{}"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.