CVE-2026-73426mediumCWE-79

CVE-2026-73426: medium-severity vulnerability in basecamp trix

Trix: Stored XSS vulnerability through serialized attributes

Published

Follow this CVE+ Monitor trix+ Monitor trix

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.6epss 0.3%
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session and may perform unauthorized actions or disclose sensitive information. This issue is fixed in version 2.1.17.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected products
basecamp · trix
Related CVEs — basecamp trix

In the same product, most dangerous first.

CVE-2024-34341MEDIUMThe Trix Editor Contains an Arbitrary Code Execution VulnerabilityEPSS 0.8%CVE-2025-46812LOWTrix vulnerable to Cross-site Scripting on copy & pasteEPSS 0.7%CVE-2026-73427LOWTrix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)EPSS 0.6%CVE-2024-43368MEDIUMTrix has a Cross-Site Scripting (XSS) vulnerability on copy & pasteEPSS 0.5%CVE-2024-53847MEDIUMTrix vulnerable to Cross-site Scripting on copy & pasteEPSS 0.5%CVE-2025-21610MEDIUMTrix allows Cross-site Scripting via `javascript:` url in a linkEPSS 0.4%