CVE-2026-73428

Received Received - Intake

Stored XSS in Trix Rich Text Editor

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `<span>` with an empty `data-trix-attachment="{}"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73428

Affected Vendors & Products

Vendor	Product	Version / Range
basecamp	trix	2.1.18

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Trix is a rich text editor vulnerable to stored cross-site scripting (XSS) when crafted HTML is pasted into it. The issue occurs because HTMLParser processes a mock attachment in a span tag with an empty data-trix-attachment value, allowing unvalidated javascript: URIs to execute when users render and click the content. This flaw is fixed in version 2.1.18.

Detection Guidance

Detection involves checking for Trix editor versions prior to 2.1.18. Inspect installed packages using commands like 'npm list trix' or 'gem list trix' depending on your environment. Review HTML content for suspicious javascript: URIs in href attributes or empty data-trix-attachment values.

Impact Analysis

An attacker could exploit this to execute malicious scripts in the context of a user's session, potentially stealing sensitive data, session cookies, or performing unauthorized actions on behalf of the user. Users interacting with the compromised content may unknowingly trigger the script.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using vulnerable versions may face compliance breaches, legal penalties, or reputational damage.

Mitigation Strategies

Upgrade Trix to version 2.1.18 or later immediately. If server-side HTML sanitization is used, ensure it filters javascript: URIs and untrusted attributes. Monitor pasted content for malicious payloads and apply strict input validation.

Hi! I’m here to help you understand CVE-2026-73428. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70