CVE-2026-73426: Trix Rich Text Editor XSS Vulnerability

CVE-2026-73426 Overview

CVE-2026-73426 is a stored cross-site scripting (XSS) vulnerability in Trix, the what-you-see-is-what-you-get rich text editor maintained by Basecamp. Versions prior to 2.1.17 fail to properly sanitize the data-trix-serialized-attributes attribute, allowing a bypass of the DOMPurify sanitizer. An attacker with the ability to submit content can craft HTML that carries a malicious payload inside this attribute. When the content is rendered to another user, arbitrary JavaScript executes in the victim's session context. The issue is tracked under [CWE-79] and fixed in Trix version 2.1.17.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling unauthorized actions and disclosure of sensitive information tied to that session.

Affected Products

Basecamp Trix rich text editor versions prior to 2.1.17
Applications embedding vulnerable Trix builds via action_text-trix JavaScript assets
Rails Action Text integrations that ship the affected Trix bundle

Discovery Timeline

2026-08-18 - CVE-2026-73426 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-73426

Vulnerability Analysis

Trix uses DOMPurify to sanitize HTML content passed through the editor. The sanitizer registers an uponSanitizeAttribute hook that preserves any attribute matching the pattern /^data-trix-/. This allowlist logic runs before per-attribute inspection of dangerous values. Because data-trix-serialized-attributes matches the allowlist prefix, DOMPurify forcibly retains the attribute without inspecting its contents. Trix later deserializes this attribute back into DOM attributes when rendering a piece. If the serialized payload includes attributes such as event handlers, those attributes are written directly to the resulting nodes and executed by the browser.

Root Cause

The root cause is an overly broad allowlist in the DOMPurify hook located in src/trix/models/html_sanitizer.js. Every attribute prefixed with data-trix- is force-kept, which shifts trust to downstream deserialization logic that does not re-sanitize. The data-trix-serialized-attributes attribute carries a JSON blob of attribute name/value pairs that Trix reapplies at render time, effectively turning the sanitizer allowlist into an attribute-injection primitive [CWE-79].

Attack Vector

Exploitation requires an authenticated low-privilege user to submit crafted HTML into a Trix-backed field. The payload is stored and then rendered to other users who load the affected page. User interaction is required to trigger the payload, since it activates on render or interaction with the rendered node. The result is arbitrary JavaScript execution in the victim origin, permitting session-scoped actions and data exfiltration.

javascript

// Vulnerable sanitizer hook - src/trix/models/html_sanitizer.js (pre-2.1.17)
// Any attribute prefixed with data-trix- is force-kept, including
// data-trix-serialized-attributes which is later deserialized into DOM attributes.
DOMPurify.addHook("uponSanitizeAttribute", function (node, data) {
  const allowedAttributePattern = /^data-trix-/
  if (allowedAttributePattern.test(data.attrName)) {
    data.forceKeepAttr = true
  }
})

Source: GitHub Commit 3229c29

Detection Methods for CVE-2026-73426

Indicators of Compromise

Stored HTML in Action Text or Trix-backed database columns containing the data-trix-serialized-attributes attribute with encoded event-handler names such as onerror, onload, or onclick.
Outbound requests from user browsers to unexpected domains shortly after loading pages that render user-generated Trix content.
Server logs showing POST submissions to Trix-backed endpoints with payloads containing serialized attribute JSON that references script-executing attributes.

Detection Strategies

Grep persistent stores and cached HTML for the literal string data-trix-serialized-attributes combined with event-handler substrings.
Deploy a Content Security Policy (CSP) in report-only mode and monitor script-src violations on pages rendering Trix content.
Run offline scans of Action Text records against the fixed sanitizer logic to identify pre-patch payloads that were accepted.

Monitoring Recommendations

Track the deployed version of trix and @rails/actiontext across build artifacts and flag any release below 2.1.17.
Alert on browser errors and CSP violations originating from pages that render user-authored rich text.
Correlate authentication anomalies, such as session reuse from unexpected IP addresses, with recent renders of user-submitted Trix content.

How to Mitigate CVE-2026-73426

Immediate Actions Required

Upgrade Trix to version 2.1.17 or later in all application dependencies and asset pipelines.
Rebuild and redeploy front-end bundles so cached copies of the vulnerable trix.js are replaced at the CDN and browser layer.
Audit stored Action Text and Trix content for existing data-trix-serialized-attributes payloads and sanitize or purge malicious entries.

Patch Information

The fix is included in Trix v2.1.17 and merged via pull request #1282. The patch adds an explicit deny in the uponSanitizeAttribute hook that drops data-trix-serialized-attributes before the allowlist prefix check. See the GitHub Security Advisory GHSA-qmpg-8xg6-ph5q for advisory details.