CVE-2026-73426

Name of the Vulnerable Software and Affected Versions Trix versions prior to 2.1.17

Description Trix is a what-you-see-is-what-you-get rich text editor. The software is susceptible to cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites, when the data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing this attribute with a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session, potentially leading to unauthorized actions or the disclosure of sensitive information.

Recommendations Update to version 2.1.17 or later.