Read the docs
TI-2026-51546 Aliases CVE-2026-73428GHSA-53g2-mvcc-q9x3

Trix: Stored XSS via HTMLParser attribute injection on paste

Priority LOW 21CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `<span>` with an empty `data-trix-attachment="{}"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00353 29th percentileScored 2026-11-07
Fix Fixed trix (basecamp): 2.1.18trix (npm): 2.1.18+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
basecamptrixbefore 2.1.182.1.18Patch availableCNA
—trix (npm)before 2.1.182.1.18Patch availableGHSA-53g2-mvcc-q9x3
—action_text-trix (RubyGems)before 2.1.182.1.18Patch availableGHSA-53g2-mvcc-q9x3
  • trix Vendorbasecamp Affected before 2.1.18 Fixed in 2.1.18 Patch available CNA
  • trix (npm) Vendor— Affected before 2.1.18 Fixed in 2.1.18 Patch available GHSA-53g2-mvcc-q9x3
  • action_text-trix (RubyGems) Vendor— Affected before 2.1.18 Fixed in 2.1.18 Patch available GHSA-53g2-mvcc-q9x3

Remediation

  • Fix · CNA trix (basecamp) Fixed in 2.1.18
  • Fix · GHSA-53g2-mvcc-q9x3 trix (npm) Fixed in 2.1.18 Advisory →
  • Fix · GHSA-53g2-mvcc-q9x3 action_text-trix (RubyGems) Fixed in 2.1.18 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-73428
  2. 2026-10-03 Alias added: GHSA-53g2-mvcc-q9x3

References

Other 5

  • TI-2023-18436 Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1… CVSS 3.1HIGH 7.5
  • TI-2024-29019 Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste CVSS 3.1MEDIUM 6.5
  • TI-2024-36043 Trix vulnerable to Cross-site Scripting on copy & paste CVSS 4.0MEDIUM 5.1
  • TI-2018-16075 easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in… CVSS 3.1MEDIUM 6.1
  • TI-2024-22682 The Trix Editor Contains an Arbitrary Code Execution Vulnerability CVSS 3.1MEDIUM 5.4
  • TI-2025-15570 Trix allows Cross-site Scripting via `javascript:` url in a link CVSS 3.1MEDIUM 5.3
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences