{"id":"EUVD-2026-58520","revision":"5edc2f0e8e2a4290b4e856292b60e00f","records":[{"revision":"5edc2f0e8e2a4290b4e856292b60e00f","observedAt":"2026-11-09T15:10:29.17+00:00","statement":{"source":"euvd","id":"EUVD-2026-58520","aliases":["CVE-2026-73428","GHSA-53g2-mvcc-q9x3"],"title":"Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `<span…","description":"Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `<span>` with an empty `data-trix-attachment=\"{}\"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","score":4.6,"severity":null}],"references":["https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3","https://github.com/basecamp/trix/pull/1293","https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c","https://github.com/basecamp/trix/releases/tag/v2.1.18"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-58520","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 13, 2026, 10:04:19 PM","dateUpdated":"Aug 14, 2026, 6:06:36 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-58520","identifiers":["EUVD-2026-58520","CVE-2026-73428","GHSA-53g2-mvcc-q9x3"]},"retained":false,"historicalAffected":[]}],"coverage":[]}