CVE-2026-73426mediumCWE-79

CVE-2026-73426: falha de média gravidade em basecamp trix

Trix: Stored XSS vulnerability through serialized attributes

Publicada em

Seguir esta CVE+ Monitorar trix+ Monitorar trix

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.6epss 0.3%
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session and may perform unauthorized actions or disclose sensitive information. This issue is fixed in version 2.1.17.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Produtos afetados
basecamp · trix
CVEs relacionadas — basecamp trix

No mesmo produto, das mais perigosas para as menos.

CVE-2024-34341MEDIUMThe Trix Editor Contains an Arbitrary Code Execution VulnerabilityEPSS 0.8%CVE-2025-46812LOWTrix vulnerable to Cross-site Scripting on copy & pasteEPSS 0.7%CVE-2026-73427LOWTrix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)EPSS 0.6%CVE-2024-43368MEDIUMTrix has a Cross-Site Scripting (XSS) vulnerability on copy & pasteEPSS 0.5%CVE-2024-53847MEDIUMTrix vulnerable to Cross-site Scripting on copy & pasteEPSS 0.5%CVE-2025-21610MEDIUMTrix allows Cross-site Scripting via `javascript:` url in a linkEPSS 0.4%