Vulnerability-Lookup

CVE-2026-73428 (GCVE-0-2026-73428)

Vulnerability from cvelistv5 – Published: 2026-08-13 22:04 – Updated: 2026-08-14 18:06

Title

Trix: Stored XSS via HTMLParser attribute injection on paste

Summary

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `<span>` with an empty `data-trix-attachment="{}"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.

Severity

4.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 17:39 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/basecamp/trix/security/advisor…	x_refsource_CONFIRM
https://github.com/basecamp/trix/pull/1293	x_refsource_MISC
https://github.com/basecamp/trix/commit/9c0a993d9…	x_refsource_MISC
https://github.com/basecamp/trix/releases/tag/v2.1.18	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
basecamp	trix	Affected: < 2.1.18

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73428",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T17:39:35.455077Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T18:06:36.864Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "trix",
          "vendor": "basecamp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.18"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `\u003cspan\u003e` with an empty `data-trix-attachment=\"{}\"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T22:04:19.121Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3"
        },
        {
          "name": "https://github.com/basecamp/trix/pull/1293",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/basecamp/trix/pull/1293"
        },
        {
          "name": "https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c"
        },
        {
          "name": "https://github.com/basecamp/trix/releases/tag/v2.1.18",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/basecamp/trix/releases/tag/v2.1.18"
        }
      ],
      "source": {
        "advisory": "GHSA-53g2-mvcc-q9x3",
        "discovery": "UNKNOWN"
      },
      "title": "Trix: Stored XSS via HTMLParser attribute injection on paste"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73428",
    "datePublished": "2026-08-13T22:04:19.121Z",
    "dateReserved": "2026-08-12T14:32:11.796Z",
    "dateUpdated": "2026-08-14T18:06:36.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73428",
      "date": "2026-08-14",
      "epss": "0.00171",
      "percentile": "0.06793"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-73428\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-13T22:17:26.587\",\"lastModified\":\"2026-08-14T18:19:09.413\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `\u003cspan\u003e` with an empty `data-trix-attachment=\\\"{}\\\"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"basecamp\",\"product\":\"trix\",\"versions\":[{\"version\":\"\u003c 2.1.18\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N\",\"baseScore\":4.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.1,\"impactScore\":2.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-14T17:39:35.455077Z\",\"id\":\"CVE-2026-73428\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/basecamp/trix/pull/1293\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/basecamp/trix/releases/tag/v2.1.18\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3\",\"source\":\"security-advisories@github.com\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-08-14T14:00:43+00:00",
      "cve": "CVE-2026-73428",
      "id": "CVE-2026-73428",
      "initial_release_date": "2026-08-13T22:04:19.121000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "trix: action_text-trix: Trix: Stored Cross-Site Scripting via HTML paste allows arbitrary code execution.",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73428.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Trix: Stored XSS via HTMLParser attribute injection on paste\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-79\", \"lang\": \"en\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 4.6, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"REQUIRED\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3\"}, {\"name\": \"https://github.com/basecamp/trix/pull/1293\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/basecamp/trix/pull/1293\"}, {\"name\": \"https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c\"}, {\"name\": \"https://github.com/basecamp/trix/releases/tag/v2.1.18\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/basecamp/trix/releases/tag/v2.1.18\"}], \"affected\": [{\"vendor\": \"basecamp\", \"product\": \"trix\", \"versions\": [{\"version\": \"\u003c 2.1.18\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-13T22:04:19.121Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `\u003cspan\u003e` with an empty `data-trix-attachment=\\\"{}\\\"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.\"}], \"source\": {\"advisory\": \"GHSA-53g2-mvcc-q9x3\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-73428\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-14T17:39:35.455077Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-14T17:39:36.696Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-73428\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-08-12T14:32:11.796Z\", \"datePublished\": \"2026-08-13T22:04:19.121Z\", \"dateUpdated\": \"2026-08-14T18:06:36.864Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-53G2-MVCC-Q9X3

Vulnerability from github – Published: 2026-07-24 16:18 – Updated: 2026-08-12 20:52

Summary

Trix: Stored XSS via HTMLParser attribute injection on paste

Details

Impact

The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when crafted HTML is pasted into the editor. The HTMLParser processed a mock attachment, a <span> carrying an empty data-trix-attachment="{}". The empty attachment object caused the element to bypass attachment handling, so its data-trix-attributes were applied to a plain string piece. The pre-2.1.18 StringPiece.fromJSON accepted the href without validation, so an attacker-supplied javascript: URI was carried into the document model and emitted verbatim into the serialized HTML, executing when the content was rendered and clicked.

This is a stored XSS in any application that accepts untrusted rich text through Trix and renders the serialized output to other users. Applications that apply server-side HTML sanitization, such as the Rails built-in sanitizer, are additionally protected because the payload is neutralized on save.

This vulnerability shares its fix with GHSA-53p3-c7vp-4mcc. Both are resolved by the StringPiece.fromJSON sanitization added in 2.1.18. This advisory covers the paste and HTMLParser entry vector, while GHSA-53p3-c7vp-4mcc covers the drag-and-drop path through the fallback Level0InputController.

Patches

Users should upgrade to Trix editor version 2.1.18 or later.

References

The vulnerability was responsibly reported by HackerOne researcher newbiefromcoma.

Severity

4.6 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "trix"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "action_text-trix"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73428"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T16:18:01Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThe Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when crafted HTML is pasted into the editor. The `HTMLParser` processed a mock attachment, a `\u003cspan\u003e` carrying an empty `data-trix-attachment=\"{}\"`. The empty attachment object caused the element to bypass attachment handling, so its `data-trix-attributes` were applied to a plain string piece. The pre-2.1.18 `StringPiece.fromJSON` accepted the `href` without validation, so an attacker-supplied `javascript:` URI was carried into the document model and emitted verbatim into the serialized HTML, executing when the content was rendered and clicked.\n\nThis is a stored XSS in any application that accepts untrusted rich text through Trix and renders the serialized output to other users. Applications that apply server-side HTML sanitization, such as the Rails built-in sanitizer, are additionally protected because the payload is neutralized on save.\n\nThis vulnerability shares its fix with GHSA-53p3-c7vp-4mcc. Both are resolved by the `StringPiece.fromJSON` sanitization added in 2.1.18. This advisory covers the paste and HTMLParser entry vector, while GHSA-53p3-c7vp-4mcc covers the drag-and-drop path through the fallback Level0InputController.\n\n### Patches\n\nUsers should upgrade to Trix editor version 2.1.18 or later.\n\n### References\n\nThe vulnerability was responsibly reported by HackerOne researcher [newbiefromcoma](https://hackerone.com/newbiefromcoma).",
  "id": "GHSA-53g2-mvcc-q9x3",
  "modified": "2026-08-12T20:52:01Z",
  "published": "2026-07-24T16:18:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/basecamp/trix"
    },
    {
      "type": "WEB",
      "url": "https://github.com/basecamp/trix/releases/tag/v2.1.18"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Trix: Stored XSS via HTMLParser attribute injection on paste"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-73428 (GCVE-0-2026-73428)

GHSA-53G2-MVCC-Q9X3

Impact

Patches

References

Tags

Sightings

Nomenclature