CVE-2026-73426
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Trix, a what-you-see-is-what-you-get rich text editor, prior to version 2.1.17 is vulnerable to cross-site scripting via a data-trix-serialized-attributes attribute that bypasses the DOMPurify sanitizer. An attacker can craft HTML with this attribute containing a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session, potentially leading to unauthorized actions or disclosure of sensitive information.
Risk Assessment
The risk is that an attacker can execute scripts in the victim's browser, potentially leading to session theft, account takeover, or data leakage.
Recommendation
It is recommended to update Trix to version 2.1.17 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session and may perform unauthorized actions or disclose sensitive information. This issue is fixed in version 2.1.17.