CVE-2026-73428

Name of the Vulnerable Software and Affected Versions Trix versions prior to 2.1.18

Description Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. The HTMLParser processes a mock attachment in a <span> with an empty data-trix-attachment value, which causes data-trix-attributes to be applied to a plain string piece. The StringPiece.fromJSON() function accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML, which executes when another user renders and clicks the content.

Recommendations Update to version 2.1.18. Apply server-side HTML sanitization to neutralize payloads on save.