Trix Editor EUVD-2026-60825

The attacker must have the ability to submit content that is stored and subsequently rendered by a Trix editor instance in a multi-user application - for example, write access to a post, comment, task, or document field backed by ActionText. Victim interaction is required: a separate user must load the page containing the attacker-controlled content (UI:R per CVSS vector). The CVSS PR:L metric confirms that at least low-level authenticated access is needed to inject content; unauthenticated exploitation is not supported by the available data. Exploitation is limited to applications running Trix versions below 2.1.17 that allow user-supplied HTML to pass through Trix's rendering pipeline without independent post-processing. Applications where all Trix content is authored exclusively by fully trusted operators, or where a separate sanitizer explicitly strips data-trix-serialized-attributes before storage, are not exploitable via this specific vector.

The CVSS base score of 4.6 (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) correctly categorizes this as a medium-severity finding: the attacker must control storable content (PR:L) and a victim must load the rendered page (UI:R), which meaningfully limits opportunistic mass exploitation. No EPSS data was supplied in the source intelligence, and no CISA KEV listing was identified, indicating no confirmed widespread exploitation campaign at time of analysis. However, the published PR diff at https://github.com/basecamp/trix/pull/1282 contains a complete, functional XSS test payload demonstrating the onerror bypass, which effectively constitutes a public proof-of-concept and narrows the skill threshold for exploitation. The scope is unchanged (S:U), capping the blast radius to the victim's individual session rather than enabling server-side compromise. In multi-user Rails applications using ActionText - where untrusted users can author rich-text content viewed by privileged users such as admins - risk is materially elevated above what the base score implies; even a mid-sized municipal IT team in boleslawiec running a community intranet on Rails with ActionText should treat this as a near-term patching priority, not a routine quarterly item. No CVSS vector conflicts were identified in the provided data.

An attacker with a standard user account in a multi-user Rails ActionText application (such as a shared document editor or support-ticket system) pastes crafted HTML into a Trix editor field; the payload embeds a data-trix-attachment element whose inner content contains data-trix-serialized-attributes with an onerror handler referencing document.cookie. DOMPurify passes the attribute through without stripping it, and the malicious content is stored. When an administrator or privileged co-user loads the page containing the rendered content, the event handler fires and exfiltrates the session cookie to an attacker-controlled endpoint. A functionally identical payload is documented in the fix PR at https://github.com/basecamp/trix/pull/1282.