{"action":"Upgrade trix to 2.1.17 or later.","affected":[{"fixed":"2.1.17","introduced":"0"}],"component":"trix","cve_ids":["CVE-2026-73426"],"ecosystem":"npm","epss":0.0032,"exploited":false,"fixed_versions":["2.1.17"],"ghsa_id":"GHSA-qmpg-8xg6-ph5q","id":"tcs_01M5KEN021GDXTMQBN6DY03RMH","modified_at":"2026-09-10T03:51:00.638535568Z","published_at":"2026-03-12T17:29:30Z","references":["https://osv.dev/vulnerability/GHSA-qmpg-8xg6-ph5q","https://github.com/basecamp/trix/security/advisories/GHSA-qmpg-8xg6-ph5q","https://github.com/basecamp/trix/pull/1282","https://github.com/basecamp/trix/commit/53197ab5a142e6b0b76127cb790726b274eaf1bc","https://github.com/basecamp/trix","https://github.com/basecamp/trix/releases/tag/v2.1.17","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/action_text-trix/GHSA-qmpg-8xg6-ph5q.yml"],"severity":{"label":"medium","score":4.6},"sources":[{"source":"osv","source_id":"GHSA-qmpg-8xg6-ph5q#npm/trix","url":"https://osv.dev/vulnerability/GHSA-qmpg-8xg6-ph5q"}],"summary":"Trix has a Stored XSS vulnerability through serialized attributes"}