Stored Cross-Site Scripting in Trix Rich Text Editor by Basecamp
CVE-2026-73428
4.6MEDIUM
What is CVE-2026-73428?
The Trix rich text editor is vulnerable to stored cross-site scripting (XSS) due to improper handling of HTML input. Prior to version 2.1.18, the editor processes pasted HTML without adequate validation. This flaw allows malicious users to insert JavaScript code via a specially crafted <span> element. When another user interacts with the affected content, their browser executes the embedded script, leading to unauthorized actions within the context of the application. The issue has been mitigated in version 2.1.18, and it is recommended that users upgrade to this version or apply appropriate server-side HTML sanitization to protect against potential exploits.
Affected Version(s)
trix < 2.1.18