CVE-2026-73428
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Trix prior to version 2.1.18 is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a <span> with an empty data-trix-attachment="{}" value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and execute when another user renders and clicks the content.
Risk Assessment
An attacker can inject malicious scripts that execute in other users' browsers, potentially leading to session theft, content modification, or other damage.
Recommendation
Update Trix to version 2.1.18 or later. Apply server-side HTML sanitization to neutralize the payload.
Other vulnerabilities in Trix
See all- CVE-2026-73426Medium
Trix, a what-you-see-is-what-you-get rich text editor, prior to version 2.1.17 is vulnerable to cross-site scripting via a data-trix-serialized-attributes attribute that bypasses the DOMPurify sanitizer. An attacker can craft HTML with this attribute containing a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session, potentially leading to unauthorized actions or disclosure of sensitive information.
- CVE-2026-73427Low
Trix prior to 2.1.18 is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without Input Events Level 2 support. The StringPiece.fromJSON method trusts href attributes from the JSON payload without sanitization, allowing a draggable element containing a javascript: URI to bypass DOMPurify sanitization and inject executable JavaScript into the DOM. Exploitation requires the victim to drag and drop attacker-controlled content, and server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.
Original NVD description (English source)
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `<span>` with an empty `data-trix-attachment="{}"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS