Skip to content
OpenAdvisories

Package · RubyGems

action_text-trix

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.6
    CVE-2026-73426

    Trix: Stored XSS vulnerability through serialized attributes

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing …

    basecamp trix ruby3.2-rails-8.1 ruby3.4-rails-8.1 Wolfi npm RubyGems
  • Medium 4.6
    CVE-2026-73428

    Trix: Stored XSS via HTMLParser attribute injection on paste

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `<span>` with an empty `d…

    basecamp trix trix action_text-trix npm RubyGems
  • Medium 4.6
    GHSA-g9jg-w8vm-g96v

    Trix has a stored XSS vulnerability through its attachment attribute

    ### Impact The Trix editor, in versions prior to 2.1.16, is vulnerable to XSS attacks through attachment payloads. An attacker could inject malicious code into a data-trix-attachment attribute that, when rendered as HTML and clicked on, could execute arbitrar…

    trix action_text-trix npm RubyGems