GitHub Advisoryadvisory · RubyGems, npm

GHSA-qmpg-8xg6-ph5q Trix has a Stored XSS vulnerability through serialized attributes

MEDIUM Published 2026-03-12 Modified 2026-08-12 Official page ↗
Aliases
CVE-2026-73426
Ecosystem
RubyGems, npm
Packages
action_text-trix, trix
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-03-12

Affected packages

• RubyGems action_text-trix: < 2.1.17 → fixed in 2.1.17 • npm trix: < 2.1.17 → fixed in 2.1.17

Description

Impact The Trix editor, in versions prior to 2.1.17, is vulnerable to XSS attacks when a `data-trix-serialized-attributes` attribute bypasses the DOMPurify sanitizer. An attacker could craft HTML containing a `data-trix-serialized-attributes` attribute with a malicious payload that, when the content is rendered, could execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Patches Update Recommendation: Users should upgrade to Trix editor version 2.1.17 or later. References The XSS vulnerability was responsibly reported by Hackerone researcher newbiefromcoma.

Related

Alias · CVE (1)

  • CVE-2026-73426 Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References