CVE-2026-73426mediumCWE-79

CVE-2026-73426: fallo de gravedad media en basecamp trix

Trix: Stored XSS vulnerability through serialized attributes

Publicada el

Seguir esta CVE+ Monitorear trix+ Monitorear trix

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.6epss 0.3%
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session and may perform unauthorized actions or disclose sensitive information. This issue is fixed in version 2.1.17.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Productos afectados
basecamp · trix
CVEs relacionadas — basecamp trix

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-34341MEDIUMThe Trix Editor Contains an Arbitrary Code Execution VulnerabilityEPSS 0.8%CVE-2025-46812LOWTrix vulnerable to Cross-site Scripting on copy & pasteEPSS 0.7%CVE-2026-73427LOWTrix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)EPSS 0.6%CVE-2024-43368MEDIUMTrix has a Cross-Site Scripting (XSS) vulnerability on copy & pasteEPSS 0.5%CVE-2024-53847MEDIUMTrix vulnerable to Cross-site Scripting on copy & pasteEPSS 0.5%CVE-2025-21610MEDIUMTrix allows Cross-site Scripting via `javascript:` url in a linkEPSS 0.4%