Vulnerability · Published Aug 18, 2026 · Assigned by GitHub_M
CVE-2026-73426Trix: Stored XSS vulnerability through serialized attributes
Medium 4.6
In plain English
A medium-severity cross-site scripting in trix from basecamp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session and may perform unauthorized actions or disclose sensitive information. This issue is fixed in version 2.1.17.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| RubyGems | action_text-trix | 2.1.17 | GHSA-qmpg-8xg6-ph5q |
| npm | trix | 2.1.17 | GHSA-qmpg-8xg6-ph5q |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
References
- https://github.com/basecamp/trix/security/advisories/GHSA-qmpg-8xg6-ph5q x_refsource_CONFIRM
- https://github.com/basecamp/trix/pull/1282 x_refsource_MISC
- https://github.com/basecamp/trix/commit/3229c29c771ded4d247ed79b2ccd2cd05c4e74b4 x_refsource_MISC
- https://github.com/basecamp/trix/commit/53197ab5a142e6b0b76127cb790726b274eaf1bc x_refsource_MISC
- https://github.com/basecamp/trix/releases/tag/v2.1.17 x_refsource_MISC