npm/trix CVE-2026-73426: medium 4.6, EPSS 0.32%
Trix has a Stored XSS vulnerability through serialized attributes
Action: Upgrade trix to 2.1.17 or later.
npm i trix@2.1.17Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.17 | - |
Fixed versions
| 2.1.17 |
Sources
- osv: GHSA-qmpg-8xg6-ph5q#npm/trix
- https://github.com/basecamp/trix/security/advisories/GHSA-qmpg-8xg6-ph5q
- https://github.com/basecamp/trix/pull/1282
- https://github.com/basecamp/trix/commit/53197ab5a142e6b0b76127cb790726b274eaf1bc
- https://github.com/basecamp/trix
- https://github.com/basecamp/trix/releases/tag/v2.1.17
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/action_text-trix/GHSA-qmpg-8xg6-ph5q.yml
CVE-2026-73426 · published · modified · JSON