{"id":"EUVD-2026-58520","enisaUuid":"9f56c240-69ac-3695-917a-f411509f81da","description":"Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `\u003cspan\u003e` with an empty `data-trix-attachment\u003d\"{}\"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.","datePublished":"Aug 13, 2026, 10:04:19 PM","dateUpdated":"Aug 14, 2026, 6:06:36 PM","baseScore":4.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","references":"https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3\nhttps://github.com/basecamp/trix/pull/1293\nhttps://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c\nhttps://github.com/basecamp/trix/releases/tag/v2.1.18\n","aliases":"CVE-2026-73428\nGHSA-53g2-mvcc-q9x3\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"7ab98ccb-086f-3732-b02c-50adacd44adc","product":{"name":"trix","vendor":{"name":"basecamp"}},"product_version":"\u003c 2.1.18"}],"enisaIdVendor":[{"id":"5bf83ff6-18e1-3b25-ada6-31056e7d7c9f","vendor":{"name":"basecamp"}}],"enisaIdVulnerability":[{"id":"21025be6-30c4-3335-bae0-c534b49614e7","vulnerability":{"id":"GHSA-53g2-mvcc-q9x3","description":"Trix: Stored XSS via HTMLParser attribute injection on paste","datePublished":"Jul 24, 2026, 4:18:01 PM","dateUpdated":"Aug 12, 2026, 8:52:01 PM","baseScore":0.0,"references":"https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3\nhttps://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c\nhttps://github.com/basecamp/trix\nhttps://github.com/basecamp/trix/releases/tag/v2.1.18\n","enisa_id":"EUVD-2026-58520\n","aliases":"CVE-2026-73428\nGHSA-53g2-mvcc-q9x3\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:50:23 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"dc64191c-1f9c-3b75-81c5-da676b848675","vulnerability":{"id":"CVE-2026-73428","description":"Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `\u003cspan\u003e` with an empty `data-trix-attachment\u003d\"{}\"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.","datePublished":"Aug 13, 2026, 10:04:19 PM","dateUpdated":"Aug 14, 2026, 6:06:36 PM","status":"PUBLISHED","baseScore":4.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","references":"https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3\nhttps://github.com/basecamp/trix/pull/1293\nhttps://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c\nhttps://github.com/basecamp/trix/releases/tag/v2.1.18\n","enisa_id":"EUVD-2026-58520\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Nov 9, 2026, 3:06:01 PM","vulnerabilityProduct":[{"id":"3145f1eb-c05e-3879-aa39-e844045d52d5","product":{"name":"trix","vendor":{"name":"basecamp"}},"product_version":"\u003c 2.1.18"}],"vulnerabilityVendor":[{"id":"9705d01c-04d1-3912-b6ba-503d1c3a32ee","vendor":{"name":"basecamp"}}]}}],"enisaIdAdvisory":[]}