CVE-2026-73428: Basecamp Trix stored XSS via HTMLParser attribute injection on paste

CVE-2026-73428 · Severity: medium · CVSS 4.6 · Published 2026-08-13

Trix is a popular web-based rich text editor used in many applications to allow users to compose formatted content. The vulnerability allows an attacker to paste specially crafted HTML that executes malicious JavaScript when other users view or interact with the stored content. This is a stored (persistent) XSS attack that could compromise user sessions, steal credentials, or perform actions on behalf of affected users. Applications using server-side HTML sanitization are partially protected, but client-side rendering of unsanitized content is at risk.

Technologies: trix (npm), action_text-trix (RubyGems). Vendors: npm, RubyGems.

Quick answers

Is CVE-2026-73428 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-73428 being exploited in the wild.
How severe is CVE-2026-73428?
Medium severity, with a CVSS score of 4.6, published 13 August 2026.
Which products and versions are affected?
trix (npm) SEMVER:introduced=0,fixed=2.1.18; action_text-trix (RubyGems) ECOSYSTEM:introduced=0,fixed=2.1.18.
Is there a fix for CVE-2026-73428?
Yes. trix (npm): upgrade to 2.1.18 or later; action_text-trix (RubyGems): upgrade to 2.1.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73428 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-73428?
Check whether you run trix (npm) or action_text-trix (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • trix (npm): upgrade to 2.1.18 or later
    npm install trix@2.1.18
  • action_text-trix (RubyGems): upgrade to 2.1.18 or later
    bundle update action_text-trix

Technical details

The vulnerability is a stored XSS (CWE-79) in Trix's HTMLParser and StringPiece deserialization. When processing pasted HTML, the parser encounters a mock attachment element (a <span> with empty data-trix-attachment="{}") that bypasses attachment handling and applies its data-trix-attributes to a plain string piece. The StringPiece.fromJSON method in versions prior to 2.1.18 accepted href values without validation, allowing attacker-supplied javascript: URIs to pass through unchanged into the document model. These URIs are then emitted verbatim in the serialized HTML output and execute when users click the link. The attack requires user interaction (pasting malicious content) but results in persistent XSS affecting all users viewing the content. The fix, released in version 2.1.18, adds sanitization to StringPiece.fromJSON to neutralize malicious URIs. Server-side HTML sanitization provides defense-in-depth protection.

Affected products

  • Basecamp Trix < 2.1.18
  • Basecamp action_text-trix < 2.1.18

Identifiers

  • CVE-2026-73428
  • GHSA-53g2-mvcc-q9x3

Timeline

  • 2026-07-24: disclosed: Vulnerability publicly disclosed via GitHub advisory GHSA-53g2-mvcc-q9x3
  • 2026-03-26: patched: Fixed in Trix version 2.1.18 with StringPiece.fromJSON sanitization

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.