Trix Editor CVE-2026-73428
MEDIUMSeverity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
S:C assigned because stored XSS causes attacker content to execute in a victim's browser - a different security domain from the attacker's session; PR:L confirmed by requirement for authenticated write access.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a <span> with an empty data-trix-attachment="{}" value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.
AnalysisAI
Stored XSS in Trix editor (all versions prior to 2.1.18) allows an authenticated low-privilege user to persist a javascript: URI payload via the paste path, which executes in victim browsers when the rendered content is viewed and the injected link is clicked. The entry vector exploits HTMLParser's mishandling of a crafted <span data-trix-attachment="{}"> element, which bypasses attachment processing and routes unvalidated attributes - including a malicious href - into the document model through StringPiece.fromJSON. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three sequential conditions must be met: (1) the attacker must hold an authenticated low-privilege session with write access to a Trix-powered editor input field (PR:L per CVSS vector - a standard user account is sufficient, no admin role required); (2) the attacker must paste crafted HTML containing a `<span data-trix-attachment="{}">` element with a `data-trix-attributes` payload embedding a `javascript:` URI as the href value; and (3) a separate victim user must view the rendered output and actively click the injected link (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.6 (Medium) accurately reflects the threat profile: network-reachable (AV:N), low complexity (AC:L), authenticated low-privilege attacker (PR:L), mandatory victim interaction (UI:R), unchanged scope (S:U), and limited confidentiality and integrity impact (C:L/I:L/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated attacker with a low-privilege account pastes crafted HTML - a `<span>` carrying `data-trix-attachment="{}"` and `data-trix-attributes` containing `{"href":"javascript:alert(document.cookie)"}` - into a Trix-powered input field such as a comment box or article body. The malicious href bypasses HTMLParser's attachment sanitization and is stored in the application database as part of the serialized Trix document. … |
| Remediation | Upgrade to Trix 2.1.18 or later, confirmed fixed in commit 9c0a993 and tagged release https://github.com/basecamp/trix/releases/tag/v2.1.18. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today