CVE-2026-73428
2 advisories.
npm/trix CVE-2026-73428: medium 4.6, EPSS 0.35%
Trix: Stored XSS via HTMLParser attribute injection on paste
Action: Upgrade trix to 2.1.18 or later.
npm i trix@2.1.18Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.18 | - |
Fixed versions
| 2.1.18 |
Sources
- osv: GHSA-53g2-mvcc-q9x3
- https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3
- https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c
- https://github.com/basecamp/trix
- https://github.com/basecamp/trix/releases/tag/v2.1.18
CVE-2026-73428 · published · modified · JSON
RubyGems/action_text-trix CVE-2026-73428: medium 4.6, EPSS 0.35%
Trix: Stored XSS via HTMLParser attribute injection on paste
Action: Upgrade action_text-trix to 2.1.18 or later.
bundle update action_text-trixAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.18 | - |
Fixed versions
| 2.1.18 |
Sources
- osv: GHSA-53g2-mvcc-q9x3#RubyGems/action_text-trix
- https://github.com/basecamp/trix/security/advisories/GHSA-53g2-mvcc-q9x3
- https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c
- https://github.com/basecamp/trix
- https://github.com/basecamp/trix/releases/tag/v2.1.18
CVE-2026-73428 · published · modified · JSON