EUVD-2026-60825Published
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can cra…
Exact source revision recorded 30 Oct 2026 11:53:25 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-73426 · Microsoft / collected KEV context
euvd · EUVD-2026-60825
- https://github.com/basecamp/trix/security/advisories/GHSA-qmpg-8xg6-ph5q
- https://github.com/basecamp/trix/pull/1282
- https://github.com/basecamp/trix/commit/3229c29c771ded4d247ed79b2ccd2cd05c4e74b4
- https://github.com/basecamp/trix/commit/53197ab5a142e6b0b76127cb790726b274eaf1bc
- https://github.com/basecamp/trix/releases/tag/v2.1.17
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.