CVE-2026-73426: Trix: Stored XSS vulnerability through serialized attributes
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session and may perform unauthorized actions or disclose sensitive information. This issue is fixed in version 2.1.17.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Trixto a version that resolves this vulnerability.Fixed in 2.1.17
Event History
Frequently Asked Questions
Which deployments are affected?
Applications using Trix versions before 2.1.17 are affected when they render attacker-crafted HTML containing the data-trix-serialized-attributes attribute. The issue is fixed in Trix 2.1.17.
What must an attacker do to exploit this issue?
An attacker needs the ability to supply or cause the application to render crafted HTML with a malicious data-trix-serialized-attributes value. Exploitation also requires a user to render that content in their session.
What is the recommended remediation?
Upgrade Trix to version 2.1.17. The provided information does not identify an alternative mitigation for environments that cannot immediately upgrade.