Trix: Stored XSS via HTMLParser attribute injection on paste

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-73428 · CVE overview and exploitation status

EUVD-2026-58520

GHSA-53g2-mvcc-q9x3

cve-program · CVE-2026-73428

• https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3
• https://github.com/basecamp/trix/pull/1293
• https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c
• https://github.com/basecamp/trix/releases/tag/v2.1.18

euvd · EUVD-2026-58520

• https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3
• https://github.com/basecamp/trix/pull/1293
• https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c
• https://github.com/basecamp/trix/releases/tag/v2.1.18

nvd · CVE-2026-73428

• https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c
• https://github.com/basecamp/trix/pull/1293
• https://github.com/basecamp/trix/releases/tag/v2.1.18
• https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3

osv · GHSA-53g2-mvcc-q9x3

• https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3
• https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c
• https://github.com/basecamp/trix
• https://github.com/basecamp/trix/releases/tag/v2.1.18

No related changes are available here.