{"id":"EUVD-2026-60825","enisaUuid":"d6538272-8818-3a64-9743-711ba1dde954","description":"Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when rendered, executes arbitrary JavaScript in the user\u0027s session and may perform unauthorized actions or disclose sensitive information. This issue is fixed in version 2.1.17.","datePublished":"Aug 18, 2026, 2:24:27 PM","dateUpdated":"Aug 18, 2026, 5:47:02 PM","baseScore":4.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","references":"https://github.com/basecamp/trix/security/advisories/GHSA-qmpg-8xg6-ph5q\nhttps://github.com/basecamp/trix/pull/1282\nhttps://github.com/basecamp/trix/commit/3229c29c771ded4d247ed79b2ccd2cd05c4e74b4\nhttps://github.com/basecamp/trix/commit/53197ab5a142e6b0b76127cb790726b274eaf1bc\nhttps://github.com/basecamp/trix/releases/tag/v2.1.17\n","aliases":"CVE-2026-73426\nGHSA-qmpg-8xg6-ph5q\n","assigner":"GitHub_M","epss":0.32,"enisaIdProduct":[{"id":"c6339a70-e02b-3ed6-8c5b-be36f097c32d","product":{"name":"trix","vendor":{"name":"basecamp"}},"product_version":"\u003c 2.1.17"}],"enisaIdVendor":[{"id":"b740cf62-cf34-323f-91ca-d4ae863b956d","vendor":{"name":"basecamp"}}],"enisaIdVulnerability":[{"id":"b29da48a-ee3f-3601-b67d-0858197f8452","vulnerability":{"id":"CVE-2026-73426","description":"Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when rendered, executes arbitrary JavaScript in the user\u0027s session and may perform unauthorized actions or disclose sensitive information. This issue is fixed in version 2.1.17.","datePublished":"Aug 18, 2026, 2:24:27 PM","dateUpdated":"Aug 18, 2026, 5:47:02 PM","status":"PUBLISHED","baseScore":4.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","references":"https://github.com/basecamp/trix/security/advisories/GHSA-qmpg-8xg6-ph5q\nhttps://github.com/basecamp/trix/pull/1282\nhttps://github.com/basecamp/trix/commit/3229c29c771ded4d247ed79b2ccd2cd05c4e74b4\nhttps://github.com/basecamp/trix/commit/53197ab5a142e6b0b76127cb790726b274eaf1bc\nhttps://github.com/basecamp/trix/releases/tag/v2.1.17\n","enisa_id":"EUVD-2026-60825\n","assigner":"GitHub_M","epss":0.32,"dataProcessed":"Nov 5, 2026, 7:14:48 AM","vulnerabilityProduct":[{"id":"eaf3886e-df76-3ad4-8de9-1fd65353549e","product":{"name":"trix","vendor":{"name":"basecamp"}},"product_version":"\u003c 2.1.17"}],"vulnerabilityVendor":[{"id":"a32aedb7-6ece-35f9-8ee6-2a96269b2e16","vendor":{"name":"basecamp"}}]}},{"id":"b75e5f1f-1488-3d1a-b14f-156ef2bf7cbf","vulnerability":{"id":"GHSA-qmpg-8xg6-ph5q","description":"Trix has a Stored XSS vulnerability through serialized attributes","datePublished":"Mar 12, 2026, 5:29:30 PM","dateUpdated":"Aug 12, 2026, 8:48:57 PM","baseScore":0.0,"references":"https://github.com/basecamp/trix/security/advisories/GHSA-qmpg-8xg6-ph5q\nhttps://github.com/basecamp/trix/pull/1282\nhttps://github.com/basecamp/trix/commit/53197ab5a142e6b0b76127cb790726b274eaf1bc\nhttps://github.com/basecamp/trix\nhttps://github.com/basecamp/trix/releases/tag/v2.1.17\nhttps://github.com/rubysec/ruby-advisory-db/blob/master/gems/action_text-trix/GHSA-qmpg-8xg6-ph5q.yml\n","enisa_id":"EUVD-2026-60825\n","aliases":"GHSA-qmpg-8xg6-ph5q\nCVE-2026-73426\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:58:58 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}