{"id":"CVE-2026-73428","aliases":["EUVD-2026-58520","GHSA-53g2-mvcc-q9x3"],"status":"published","title":"Trix: Stored XSS via HTMLParser attribute injection on paste","description":"Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `\u003cspan\u003e` with an empty `data-trix-attachment=\"{}\"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00353,"percentile":0.29395,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-07-24T16:18:01Z","modified":"2026-10-28T02:30:53Z","fixes":[{"ecosystem":"npm","package":"trix","fixed_in":["2.1.18"],"sources":["ghsa","osv"]},{"ecosystem":"RubyGems","package":"action_text-trix","fixed_in":["2.1.18"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"trix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.18"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"action_text-trix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.18"}]}]},{"source":"osv","ecosystem":"npm","package":"trix","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.18"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"action_text-trix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.18"}]}],"versions":["0.0.1","2.1.15","2.1.16","2.1.17"]}],"products":[{"vendor":"basecamp","product":"trix"}],"references":[{"url":"https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/basecamp/trix/pull/1293","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/basecamp/trix/releases/tag/v2.1.18","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-53g2-mvcc-q9x3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73428.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73428","tags":["advisory"]},{"url":"https://github.com/basecamp/trix","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-73428","title":"Trix: Stored XSS via HTMLParser attribute injection on paste","description":"Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `\u003cspan\u003e` with an empty `data-trix-attachment=\"{}\"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.","status":"published","published":"2026-08-13T22:04:19.121Z","modified":"2026-08-14T18:06:36.864Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:43:33.766176Z"}],"euvd":[{"id":"EUVD-2026-58520","description":"Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `\u003cspan\u003e` with an empty `data-trix-attachment=\"{}\"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.","status":"published","published":"2026-08-13T22:04:19Z","modified":"2026-08-14T18:06:36Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:53.90055Z"}],"ghsa":[{"id":"GHSA-53g2-mvcc-q9x3","title":"Trix: Stored XSS via HTMLParser attribute injection on paste","description":"### Impact\n\nThe Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when crafted HTML is pasted into the editor. The `HTMLParser` processed a mock attachment, a `\u003cspan\u003e` carrying an empty `data-trix-attachment=\"{}\"`. The empty attachment object caused the element to bypass attachment handling, so its `data-trix-attributes` were applied to a plain string piece. The pre-2.1.18 `StringPiece.fromJSON` accepted the `href` without validation, so an attacker-supplied `javascript:` URI was carried into the document model and emitted verbatim into the serialized HTML, executing when the content was rendered and clicked.\n\nThis is a stored XSS in any application that accepts untrusted rich text through Trix and renders the serialized output to other users. Applications that apply server-side HTML sanitization, such as the Rails built-in sanitizer, are additionally protected because the payload is neutralized on save.\n\nThis vulnerability shares its fix with GHSA-53p3-c7vp-4mcc. Both are resolved by the `StringPiece.fromJSON` sanitization added in 2.1.18. This advisory covers the paste and HTMLParser entry vector, while GHSA-53p3-c7vp-4mcc covers the drag-and-drop path through the fallback Level0InputController.\n\n### Patches\n\nUsers should upgrade to Trix editor version 2.1.18 or later.\n\n### References\n\nThe vulnerability was responsibly reported by HackerOne researcher [newbiefromcoma](https://hackerone.com/newbiefromcoma).","status":"published","published":"2026-07-24T16:18:01Z","modified":"2026-08-12T20:52:02Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:41:00.097339Z"}],"nvd":[{"id":"CVE-2026-73428","description":"Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `\u003cspan\u003e` with an empty `data-trix-attachment=\"{}\"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.","status":"published","published":"2026-08-13T22:17:26.587Z","modified":"2026-09-18T20:09:01.757Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:37.557758Z"}],"osv":[{"id":"CVE-2026-73428","title":"Trix: Stored XSS via HTMLParser attribute injection on paste","description":"Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `\u003cspan\u003e` with an empty `data-trix-attachment=\"{}\"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.","status":"published","published":"2026-08-13T22:04:19.121Z","modified":"2026-10-28T02:30:53.338225815Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:16.365946Z"},{"id":"GHSA-53g2-mvcc-q9x3","title":"Trix: Stored XSS via HTMLParser attribute injection on paste","description":"### Impact\n\nThe Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when crafted HTML is pasted into the editor. The `HTMLParser` processed a mock attachment, a `\u003cspan\u003e` carrying an empty `data-trix-attachment=\"{}\"`. The empty attachment object caused the element to bypass attachment handling, so its `data-trix-attributes` were applied to a plain string piece. The pre-2.1.18 `StringPiece.fromJSON` accepted the `href` without validation, so an attacker-supplied `javascript:` URI was carried into the document model and emitted verbatim into the serialized HTML, executing when the content was rendered and clicked.\n\nThis is a stored XSS in any application that accepts untrusted rich text through Trix and renders the serialized output to other users. Applications that apply server-side HTML sanitization, such as the Rails built-in sanitizer, are additionally protected because the payload is neutralized on save.\n\nThis vulnerability shares its fix with GHSA-53p3-c7vp-4mcc. Both are resolved by the `StringPiece.fromJSON` sanitization added in 2.1.18. This advisory covers the paste and HTMLParser entry vector, while GHSA-53p3-c7vp-4mcc covers the drag-and-drop path through the fallback Level0InputController.\n\n### Patches\n\nUsers should upgrade to Trix editor version 2.1.18 or later.\n\n### References\n\nThe vulnerability was responsibly reported by HackerOne researcher [newbiefromcoma](https://hackerone.com/newbiefromcoma).","status":"published","published":"2026-07-24T16:18:01Z","modified":"2026-08-12T21:11:05.764982Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:37.864461Z"}]}}