CVE-2026-73426
Received Received - Intake

XSS in Trix Editor via data-trix-serialized-attributes

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session and may perform unauthorized actions or disclose sensitive information. This issue is fixed in version 2.1.17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-73426
EUVD
EUVD-2026-60825

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
basecamp trix to 2.1.17 (exc)
basecamp trix 2.1.17

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73426 is a stored Cross-Site Scripting (XSS) vulnerability in the Trix rich text editor affecting versions prior to 2.1.17. It occurs when the data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer, allowing an attacker to inject malicious HTML or JavaScript payloads. When rendered, this payload executes arbitrary code within the user's session, potentially leading to unauthorized actions or data exposure.

Detection Guidance

This vulnerability is specific to the Trix editor library and requires checking the version of Trix in use. Inspect your application's dependencies or package files (e.g., package.json, Gemfile, or vendor directories) for Trix versions prior to 2.1.17. No network or system-level commands are applicable as this is a client-side web application vulnerability.

Impact Analysis

This vulnerability allows an attacker to execute arbitrary JavaScript in your session when you view or interact with content containing the malicious payload. This could lead to unauthorized actions performed on your behalf, theft of sensitive information like session cookies or personal data, or further compromise of the application using the Trix editor.

Compliance Impact

This XSS vulnerability could lead to unauthorized access or disclosure of personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using vulnerable Trix versions may face compliance violations, legal liabilities, and reputational damage if exploited.

Mitigation Strategies
  • Upgrade Trix to version 2.1.17 or later immediately to patch the XSS vulnerability.
  • Review and sanitize any user-generated content that may contain the data-trix-serialized-attributes attribute before rendering.
  • Monitor for unusual activity or unauthorized actions in user sessions as a precaution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73426. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart