Executive brief
Trix is a popular open-source rich text editor used in web applications to allow users to format text. A vulnerability exists where an attacker can trick the editor into executing malicious code when a user pastes specially crafted content. This could allow an attacker to steal user session information or perform actions on behalf of other users if the application does not use additional security filters.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Trix versions prior to 2.1.18. The issue stems from the HTMLParser component incorrectly processing mock attachments (specifically <span> elements with empty data-trix-attachment attributes), which allows data-trix-attributes to be applied to plain string pieces without validation. An attacker can provide a 'javascript:' URI in the href attribute that is carried into the document model and emitted verbatim in the serialized HTML. Exploitation occurs when a user pastes the crafted HTML into the editor and the resulting content is subsequently rendered and clicked. This vulnerability is mitigated if the application uses server-side sanitization (like the Rails built-in sanitizer). A fix is available in version 2.1.18.
Affected products
- Basecamp trix < 2.1.18
- Basecamp action_text-trix < 2.1.18
Timeline
- 2026-07-09: disclosed
- 2026-07-09: patched: Version 2.1.18 released
- 2026-07-24: advisory
References
- https://api.github.com/users/newbiefromcoma
- https://github.com/newbiefromcoma
- https://api.github.com/users/newbiefromcoma/gists%7B/gist_id%7D
- https://api.github.com/users/newbiefromcoma/repos
- https://avatars.githubusercontent.com/u/79743693?v=4
- https://api.github.com/users/newbiefromcoma/events%7B/privacy%7D