CVE-2026-73426

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session and may perform unauthorized actions or disclose sensitive information. This issue is fixed in version 2.1.17.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/basecamp/trix/commit/3229c29c771ded4d247ed79b2ccd2cd05c4e74b4
https://github.com/basecamp/trix/commit/53197ab5a142e6b0b76127cb790726b274eaf1bc
https://github.com/basecamp/trix/pull/1282
https://github.com/basecamp/trix/releases/tag/v2.1.17
https://github.com/basecamp/trix/security/advisories/GHSA-qmpg-8xg6-ph5q

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-18 15:17

Updated : 2026-08-18 18:19

NVD link : CVE-2026-73426

Mitre link : CVE-2026-73426

CVE.ORG link : CVE-2026-73426

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-73426", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73426", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T17:19:19.823365Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "basecamp", "product": "trix", "versions": [{"status": "affected", "version": "< 2.1.17"}]}]}], "published": "2026-08-18T15:17:08.043", "references": [{"url": "https://github.com/basecamp/trix/commit/3229c29c771ded4d247ed79b2ccd2cd05c4e74b4", "source": "security-advisories@github.com"}, {"url": "https://github.com/basecamp/trix/commit/53197ab5a142e6b0b76127cb790726b274eaf1bc", "source": "security-advisories@github.com"}, {"url": "https://github.com/basecamp/trix/pull/1282", "source": "security-advisories@github.com"}, {"url": "https://github.com/basecamp/trix/releases/tag/v2.1.17", "source": "security-advisories@github.com"}, {"url": "https://github.com/basecamp/trix/security/advisories/GHSA-qmpg-8xg6-ph5q", "source": "security-advisories@github.com"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session and may perform unauthorized actions or disclose sensitive information. This issue is fixed in version 2.1.17."}], "lastModified": "2026-08-18T18:19:33.353", "sourceIdentifier": "security-advisories@github.com"}